PHP 7 deployment at Dailymotion • Hacker News Board

Re: PHP 7 deployment at Dailymotion

#41

Post by wdewind » Fri, Oct 14, 2016, 3:28 AM UTC

Akujin wrote: post #38

nikcub wrote: post #14

Hack and HHVM solves what is, IMO, the worst feature of the default PHP runtime environment[0] - and that is the superglobals. It wasn't mentioned in the post from Slack, but default superglobals and the earlier register_globals design decisions are the worst and most impactful wart in PHP. Because it was designed as a templating language, the default web server interface, which is CGI - will auto-expose all variable…

I don't get why people keep harping on super globals are being inherently bad. The variables are there. You can use them or ignore them. A variable definition harms you in no way other than a tiny bit of memory usage which is capped by the HTTP limit on POST and GET limits anyway. What? You think you're gonna get hacked because $_POST['ihaxyou'] is set to 'w00ts'? No one does this anymore: mysql_query("SELECT * FROM…

> Contrary to the hive mind you don't need some special encapsulation class to pull your post and get variables.

The hive mind is like that for a reason. Making it easy to do the right thing and wrong to do the wrong thing has massive effects, I'd argue the magnitude of which scale exponentially with the growth of an engineering team. Really really talented engineers make mistakes all the time. To the extent that we can systematically limit those with little to no downside we absolutely should, especially when it comes to security.

Re: PHP 7 deployment at Dailymotion

#42

Post by benguild » Fri, Oct 14, 2016, 3:28 AM UTC

nikcub wrote: post #14

Hack and HHVM solves what is, IMO, the worst feature of the default PHP runtime environment[0] - and that is the superglobals. It wasn't mentioned in the post from Slack, but default superglobals and the earlier register_globals design decisions are the worst and most impactful wart in PHP. Because it was designed as a templating language, the default web server interface, which is CGI - will auto-expose all variable…

Does it also solve the variable scope issue? I moved away from PHP a while ago, but all this sounds like a step in the right direction.

if (true) { $a=1; }

echo($a); // outputs 1

Re: PHP 7 deployment at Dailymotion

#43

Post by unabst » Fri, Oct 14, 2016, 3:30 AM UTC

Akujin wrote: post #38

nikcub wrote: post #14

Hack and HHVM solves what is, IMO, the worst feature of the default PHP runtime environment[0] - and that is the superglobals. It wasn't mentioned in the post from Slack, but default superglobals and the earlier register_globals design decisions are the worst and most impactful wart in PHP. Because it was designed as a templating language, the default web server interface, which is CGI - will auto-expose all variable…

I don't get why people keep harping on super globals are being inherently bad. The variables are there. You can use them or ignore them. A variable definition harms you in no way other than a tiny bit of memory usage which is capped by the HTTP limit on POST and GET limits anyway. What? You think you're gonna get hacked because $_POST['ihaxyou'] is set to 'w00ts'? No one does this anymore: mysql_query("SELECT * FROM…

In all seriousness, shouldn't all the frameworks just have some validation built in? Being that this is such a "global" WTF problem.

I would love to be able to say ini_set('sanitize_rest', true) and deal with errors that might result from that knowing at least the strings are safe. Or have functions like sanitize_string($str) and have the documentation encourage it everywhere. I mean, aren't we all just implementing those on our own anyway?

I know that obviously there are already functions for type checks etc, but the idea is to make it even easier, more obvious, and functions directly targeting the problem, even if they are mere aliases.

When a mistake is easy, the solution should be made easier.

Re: PHP 7 deployment at Dailymotion

#44

Post by Goopplesoft » Fri, Oct 14, 2016, 3:30 AM UTC

Akujin wrote: post #38

nikcub wrote: post #14

Hack and HHVM solves what is, IMO, the worst feature of the default PHP runtime environment[0] - and that is the superglobals. It wasn't mentioned in the post from Slack, but default superglobals and the earlier register_globals design decisions are the worst and most impactful wart in PHP. Because it was designed as a templating language, the default web server interface, which is CGI - will auto-expose all variable…

I don't get why people keep harping on super globals are being inherently bad. The variables are there. You can use them or ignore them. A variable definition harms you in no way other than a tiny bit of memory usage which is capped by the HTTP limit on POST and GET limits anyway. What? You think you're gonna get hacked because $_POST['ihaxyou'] is set to 'w00ts'? No one does this anymore: mysql_query("SELECT * FROM…

> What's with people expecting frameworks to do everything for them these days?

I don't think that's the expectation. PHPs reputation seems to surround the fact that it tends to be (or was) the first language amateur coders dabbled with. That crowd is especially susceptible (at least before mysqli, etc) to making mistakes that amount to serious security vulnerabilities. Historically, these seemingly benign things that can only go bad if you dont know better, do go bad [1]. It seems that this lead rampant conflation of whether php is a bad language and whether php made it easier to do things in an unsafe way. Frameworks that create safer environments for devs (especially newer ones) are certainly a good thing and the good frameworks often get out of your way when you need them to.

[1] https://github.com/search?p=3&q=extension:php+mysql_query+%2...

Re: PHP 7 deployment at Dailymotion

#45

Post by cjhanks » Fri, Oct 14, 2016, 3:43 AM UTC

benguild wrote: post #42

nikcub wrote: post #14

Hack and HHVM solves what is, IMO, the worst feature of the default PHP runtime environment[0] - and that is the superglobals. It wasn't mentioned in the post from Slack, but default superglobals and the earlier register_globals design decisions are the worst and most impactful wart in PHP. Because it was designed as a templating language, the default web server interface, which is CGI - will auto-expose all variable…

Does it also solve the variable scope issue? I moved away from PHP a while ago, but all this sounds like a step in the right direction. if (true) { $a=1; } echo($a); // outputs 1

That scope logic is normal in many interpreted languages. I love it in Python.

Re: PHP 7 deployment at Dailymotion

#46

Post by SomeCallMeTim » Fri, Oct 14, 2016, 3:50 AM UTC

Goopplesoft wrote: post #44

Akujin wrote: post #38

Earlier quoted context omitted.

I don't get why people keep harping on super globals are being inherently bad. The variables are there. You can use them or ignore them. A variable definition harms you in no way other than a tiny bit of memory usage which is capped by the HTTP limit on POST and GET limits anyway. What? You think you're gonna get hacked because $_POST['ihaxyou'] is set to 'w00ts'? No one does this anymore: mysql_query("SELECT * FROM…

> What's with people expecting frameworks to do everything for them these days? I don't think that's the expectation. PHPs reputation seems to surround the fact that it tends to be (or was) the first language amateur coders dabbled with. That crowd is especially susceptible (at least before mysqli, etc) to making mistakes that amount to serious security vulnerabilities. Historically, these seemingly benign things tha…

>PHPs reputation seems to surround the fact that it tends to be (or was) the first language amateur coders dabbled with.

That's certainly part of it. JavaScript suffers the same hate today -- amateur and junior developers produce thousands of lines of crap per year, and people blame it on the language.

But PHP itself is just a mess. I'm an experience developer (about 30 years at this point), and about 12 years ago I decided to do a volunteer project for a nonprofit in PHP. Finished the project and the nonprofit used it for at least 10 years -- they may still be using it for all I know.

Never. Again. I can't stand PHP and I will avoid its language and ecosystem like the plague. Even if they've fixed some of the problems in the core language and added types, the "standard" libraries were a random pile of mismatched garbage where the mysql_xxxx functions could have parameter signatures in different orders than the pg_xxxx versions. Maybe they've fixed that as well, but they'd have to break backward compatibility in pretty awkward ways to achieve that.

I don't even remember all the other things that tortured me, but it wasn't fun.

And it's not asynchronous. There's not even a good reason to use a synchronous language for web development today. Not to mention the ease of running NodeJS code in a debugger, or running tests in a browser and debugging it there...

I'm using TypeScript and Go for all my web related code moving forward. Something better comes along, and I'll consider it. But PHP was just a nightmare. (Elm on client? Maybe, under the right circumstances?)

Re: PHP 7 deployment at Dailymotion

#47

Post by haimez » Fri, Oct 14, 2016, 3:51 AM UTC

cjhanks wrote: post #45

benguild wrote: post #42

Earlier quoted context omitted.

Does it also solve the variable scope issue? I moved away from PHP a while ago, but all this sounds like a step in the right direction. if (true) { $a=1; } echo($a); // outputs 1

That scope logic is normal in many interpreted languages. I love it in Python.

Python does support block scoping- so no- it doesn't work there. Also, if you need to use variables in outer scopes, it's ok to declare them there. There is literally, and I mean this, literally- no possible justification for using inner-scoped variables in an outer scope that they weren't declared in.

Re: PHP 7 deployment at Dailymotion

#48

Post by SomeCallMeTim » Fri, Oct 14, 2016, 3:53 AM UTC

jpgvm wrote: post #31

brianwawok wrote: post #28

Earlier quoted context omitted.

See I can't decide on this. What is a good language? Java? If all newbs picked up Java as language #1.. would their apps be better? Or would the really bad devs writing copy paste stack overflow code just be unable to understand it, so they would quit? Like is it safer because it keeps out knuckle-draggers, or safer because it is actually safer? Cuz I can write some horrible Java code that will rival anything you can…

As I said, by all means you can write bad code in good languages. I'm not saying choosing a good language excludes all possible bad code, only that they provide some guidance on better practices. So you mention Java. Java enforces OOP. Now OOP may not be the best paradigm always, however its a vast improvement on inline procedural PHP. That isn't to say you can't write some horribly modelled Java code, but the fact t…

It rare that I see good Java code, especially that written by junior developers.

I think OO is a hard concept to get right. I know it took me years to master, and one of my epiphanies about OO design is that it's not always appropriate. Yes I can tell you the best OO approach to a problem, but I can also often tell you a better approach that isn't OO.

Re: PHP 7 deployment at Dailymotion

#49

Post by Akujin » Fri, Oct 14, 2016, 3:55 AM UTC

wdewind wrote: post #41

Akujin wrote: post #38

Earlier quoted context omitted.

I don't get why people keep harping on super globals are being inherently bad. The variables are there. You can use them or ignore them. A variable definition harms you in no way other than a tiny bit of memory usage which is capped by the HTTP limit on POST and GET limits anyway. What? You think you're gonna get hacked because $_POST['ihaxyou'] is set to 'w00ts'? No one does this anymore: mysql_query("SELECT * FROM…

> Contrary to the hive mind you don't need some special encapsulation class to pull your post and get variables. The hive mind is like that for a reason. Making it easy to do the right thing and wrong to do the wrong thing has massive effects, I'd argue the magnitude of which scale exponentially with the growth of an engineering team. Really really talented engineers make mistakes all the time. To the extent that we…

I think people are also confusing an old issue from PHP 4.x where if you had $_POST['somevar'] it would actually have an alias automatically set as $somevar in the global userspace. This was turned off by default a long time ago and is the main real security issue when it comes to super globals. $_POST and $_GET are just the normal way to access POST and GET vars. There's nothing inherently insecure about it.

Re: PHP 7 deployment at Dailymotion

#50

Post by mastazi » Fri, Oct 14, 2016, 3:57 AM UTC

jpgvm wrote: post #31

brianwawok wrote: post #28

Earlier quoted context omitted.

See I can't decide on this. What is a good language? Java? If all newbs picked up Java as language #1.. would their apps be better? Or would the really bad devs writing copy paste stack overflow code just be unable to understand it, so they would quit? Like is it safer because it keeps out knuckle-draggers, or safer because it is actually safer? Cuz I can write some horrible Java code that will rival anything you can…

As I said, by all means you can write bad code in good languages. I'm not saying choosing a good language excludes all possible bad code, only that they provide some guidance on better practices. So you mention Java. Java enforces OOP. Now OOP may not be the best paradigm always, however its a vast improvement on inline procedural PHP. That isn't to say you can't write some horribly modelled Java code, but the fact t…

> by all means you can write bad code in good languages

I think the main criticism of the GP was the fact that you use the expression "good languages" without defining what makes a language "good".

> not be the best paradigm always

same as above, what makes a paradigm "best"?

> vast improvement on inline procedural PHP.

but why you assume that the majority of PHP codebases are written in an "inline procedural" style? Do you have any evidence? Regarding the "procedural" part, the only large project that is not OOP-based is Wordpress, and even there spaghetti code (which I assume is what you mean by "inline") is AFAIK frowned upon by the community.

> the fact that modelling tools are so explicit and forced on the user

You need to accept the fact that many people may not like the "opinionated" nature of some language, (in fact that inflexibility that you mentioned is something I dislike about Java); often, a language may or may not be the right tool for a specific job precisely because of those opinionated bits.