Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP 7 deployment at Dailymotion

engineering.dailymotion.com

Post reply on HN
Print view View original

71–80 of 166 posts

Re: PHP 7 deployment at Dailymotion

#71

Post by wyager »

jonursenbach wrote: post #24
wyager wrote: post #17

Earlier quoted context omitted.

Saying that superglobals are the worst thing about PHP is like saying "the worst thing about x86 Assembly is the mnemonics". It misses the point entirely. The worst thing about PHP is that it is fundamentally not well designed and therefore makes developing high-quality software much harder than it needs to be. It also makes developing extremely low-quality software easy, which could be good or bad depending on your…

You can make low-quality software in any language, PHP just happens to be easier to pick up.

This is the most pernicious and annoying technicality that advocates of low-quality languages invoke. PHP does not actively work against bad or just plain wrong code, and its construction actively encourages bad code. It's missing aspects that we know to be tremendously useful for writing high-quality correct code.

You can write low-quality software in e.g. rust, but you're going to work a lot harder at it. Rust (again, just as an example) also makes it easier to write high-quality software.

This is really the only metric by which you can judge the quality of a language, since in the end they're all (mostly) Turing complete.

Re: PHP 7 deployment at Dailymotion

#72

Post by unabst »

kijin wrote: post #56
unabst wrote: post #43

Earlier quoted context omitted.

In all seriousness, shouldn't all the frameworks just have some validation built in? Being that this is such a "global" WTF problem. I would love to be able to say ini_set('sanitize_rest', true) and deal with errors that might result from that knowing at least the strings are safe. Or have functions like sanitize_string($str) and have the documentation encourage it everywhere. I mean, aren't we all just implementing…

PHP has already tried automatic sanitization with magic_quotes_gpc, and the results were far from secure. It is not possible to have a single sanitize() function that renders a string safe for every possible context, and to try to provide one results in nothing but complacency and false sense of security. Escaping for SQL is different from escaping for HTML, and even if you escaped a string for both, some idiot is go…

Right. I absolutely get this argument, except, the alternative to idiots misusing the tools is for those same idiots to start with no tools! And they're going to somehow implement and upload what they're building anyway...

Re: PHP 7 deployment at Dailymotion

#73

Post by kalleboo »

brianwawok wrote: post #28
jpgvm wrote: post #25

Earlier quoted context omitted.

By all means, but having the language nudge people in the right direction makes a world of difference. PHP, much like Javascript is terrible for new developers for this very reason. Learning a "good" language for lack of a better term is no more difficult than learning PHP/JS and is always worth the effort, if anything learning "good" languages is usually much easier because they are usually internally consistent.

See I can't decide on this. What is a good language? Java? If all newbs picked up Java as language #1.. would their apps be better? Or would the really bad devs writing copy paste stack overflow code just be unable to understand it, so they would quit? Like is it safer because it keeps out knuckle-draggers, or safer because it is actually safer? Cuz I can write some horrible Java code that will rival anything you can…

I often see people say that Java has pretty much been designed as (or at least evolved into) a way to let large numbers of mediocre programmers to develop acceptable-quality software.

Re: PHP 7 deployment at Dailymotion

#74

Post by blowski »

nikcub wrote: post #14

Hack and HHVM solves what is, IMO, the worst feature of the default PHP runtime environment[0] - and that is the superglobals. It wasn't mentioned in the post from Slack, but default superglobals and the earlier register_globals design decisions are the worst and most impactful wart in PHP. Because it was designed as a templating language, the default web server interface, which is CGI - will auto-expose all variable…

I don't think I've used a superglobal in 10 years, because of all the reasons you list. This is why you have a senior developer on a project doing code reviews.

Hack is a technical solution that brings lots of problems of its own. By all means use it, but not because of that feature.

Re: PHP 7 deployment at Dailymotion

#76

Post by marklgr »

SomeCallMeTim wrote: post #46
Goopplesoft wrote: post #44

Earlier quoted context omitted.

> What's with people expecting frameworks to do everything for them these days? I don't think that's the expectation. PHPs reputation seems to surround the fact that it tends to be (or was) the first language amateur coders dabbled with. That crowd is especially susceptible (at least before mysqli, etc) to making mistakes that amount to serious security vulnerabilities. Historically, these seemingly benign things tha…

>PHPs reputation seems to surround the fact that it tends to be (or was) the first language amateur coders dabbled with. That's certainly part of it. JavaScript suffers the same hate today -- amateur and junior developers produce thousands of lines of crap per year, and people blame it on the language. But PHP itself is just a mess. I'm an experience developer (about 30 years at this point), and about 12 years ago I…

Sounds like you just had a very bad experience with PHP, but it could have happened with most languages, honestly. I got (only) 20-year experience, but I have come across quite bad C codebases, poor Perl applications and terrible Java code, and I have thought 'never again' more than once, too.

Re: PHP 7 deployment at Dailymotion

#77

Post by stephenr »

SomeCallMeTim wrote: post #46
Goopplesoft wrote: post #44

Earlier quoted context omitted.

> What's with people expecting frameworks to do everything for them these days? I don't think that's the expectation. PHPs reputation seems to surround the fact that it tends to be (or was) the first language amateur coders dabbled with. That crowd is especially susceptible (at least before mysqli, etc) to making mistakes that amount to serious security vulnerabilities. Historically, these seemingly benign things tha…

>PHPs reputation seems to surround the fact that it tends to be (or was) the first language amateur coders dabbled with. That's certainly part of it. JavaScript suffers the same hate today -- amateur and junior developers produce thousands of lines of crap per year, and people blame it on the language. But PHP itself is just a mess. I'm an experience developer (about 30 years at this point), and about 12 years ago I…

> I'm an experience developer (about 30 years at this point), and about 12 years ago I decided to do a volunteer project for a nonprofit in PHP

> mysql_xxxx functions

So, you used PHP 12 years ago and comment based on that.

You have a point though. I used this internet thing about 17 years ago, it was terrible. Only dial-up. SLOW! And don't talk to me about browsers. Netscape? Internet Explorer? Ugh. Forget it. I don't care what they might have changed, or replaced or completely removed, its always terrible.

The language/runtime have problems, just like every other language/runtime that exists, but complaining about a version from 12 years ago and comparing functions that aren't even part of the language anymore seems a little odd to me.

Re: PHP 7 deployment at Dailymotion

#78

Post by jwdunne »

SomeCallMeTim wrote: post #46
Goopplesoft wrote: post #44

Earlier quoted context omitted.

> What's with people expecting frameworks to do everything for them these days? I don't think that's the expectation. PHPs reputation seems to surround the fact that it tends to be (or was) the first language amateur coders dabbled with. That crowd is especially susceptible (at least before mysqli, etc) to making mistakes that amount to serious security vulnerabilities. Historically, these seemingly benign things tha…

>PHPs reputation seems to surround the fact that it tends to be (or was) the first language amateur coders dabbled with. That's certainly part of it. JavaScript suffers the same hate today -- amateur and junior developers produce thousands of lines of crap per year, and people blame it on the language. But PHP itself is just a mess. I'm an experience developer (about 30 years at this point), and about 12 years ago I…

In fairness, PHP was in a different place 12 years ago. The language has improved in that time. There are still lots of warts but the language and ecosystem have worked together to push it forward.

I'm going to be honest, I only use it because of company lock in. I hated it for many years but some of the stuff released and some of the stuff on the way in the internals is quite exciting.

Re: PHP 7 deployment at Dailymotion

#80

Post by mastazi »

jpgvm wrote: post #57
mastazi wrote: post #50

Earlier quoted context omitted.

> by all means you can write bad code in good languages I think the main criticism of the GP was the fact that you use the expression "good languages" without defining what makes a language "good". > not be the best paradigm always same as above, what makes a paradigm "best"? > vast improvement on inline procedural PHP. but why you assume that the majority of PHP codebases are written in an "inline procedural" style?…

You are missing the forest for the trees. The statement I made is that more consistent and "opinionated" languages encourage better code. They don't enforce it, just encourage it. It is my opinion that this is valuable. I did define "good", internally consistent languages with strong guidelines for developers. I made no statements about mature PHP codebases as they are irrelevant to my argument. I do accept that peop…

> Nitpicking individual points whilst misconstruing what I said is neither useful or appreciated.

It wasn't my intention, I'm sorry if my comment came off as nit-picky. I wasn't trying to misconstrue your comment, I genuinely did not get your argument (I think I now get it, thanks to your reply).

Post reply on HN