A lot of people in techny internet spaces online are talking about a PHP embargo. What does that mean and what's going on?

you are viewing a single comment's thread
view the rest of the comments
[–] 72 points 5 days ago* (last edited 5 days ago) (35 children)

Php is a programming language from the 90s that is still popular today but is kinda the punching bag to other languages. This week the people in charge of php said they are releasing emergency patches in a couple hours and take non critical systems offline until you have patched.

This has brought on a new round of bag punching.

  • source
  • hideshow 35 child comments
  • [–] 19 points 5 days ago (20 children)
  • [–] 70 points 5 days ago (2 children)

    It’s the backbone for a lot of other software, the Wordpress ecosystem most notably. Inertia is the big factor in terms of popularity.

    Old school PHP was all about the LAMP stack (Linux as your operating system, apache as your web server, mysql as your database, php as the runtime apache would use to serve dynamic documents). The ecosystem was the real benefit that made it sensational for the era; all the pieces were designed to play nicely with one another.

    It was also really noob friendly: You could write basic html, copy it to your web server, reload in browser, and see changes. Then to make things dynamic, you sprinkle in a few <?php ?> tags in your html, copy it to the server, and it starts working! The code inside those php tags gets run by the web server and their output is written into the HTML. No reloading or resetting apache needed, and you need very little programming knowledge to start.

    The modern language is… serviceable, but lost the key features that made it great.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 27 points 5 days ago (8 children)

    Because it works. Why spend the money to rewrite something in another language when the current one is working fine?

  • source
  • parent
  • hideshow 8 child comments
  • [–] 12 points 5 days ago (2 children)

    angry Rust noises in the distance

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 4 days ago (1 child)

    That’s the problem with PHP. It’s quite easy to build something that works. It’s quite another to build something that works and is secure, scales well, is maintainable, etc. The thing is that ‘it works’ is something that people see immediately. Those other things they only get to experience when it’s too late.

    This is compounded by the fact that because it’s so easy it attracts a lot of inexperienced developers who don’t even consider things like security. Add to that that the language is full of footguns.

    That’s not to say it’s impossible to build good apps in PHP, but that is despite the language, not because of it. It takes experience, knowledge and discipline to write something secure and maintainable in PHP. Something a lot of PHP users don’t have.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 4 days ago* (last edited 3 days ago)

    Most of the main issue here where standard SQL practices were hugely insecure went by the wayside over a decade ago and the other issues are common to all internet work. PHP got to carry that heritage though.

    But like, I’ve seen early work from a guy now making huge bucks with nvidia on their streaming side where I hacked it within minutes because he just didn’t know that you can’t do security with front end JavaScript.

  • source
  • parent
  • [–] -4 points 4 days ago (2 children)

    Because it works.

    As evident from this week troubles, no it doesn't.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 4 days ago (1 child)

    Yea it does. Every language has bugs, every program has bugs. The measure of a language is not does it have bugs its how does the governing body respond to problems.

    You could have the best language, fast to run, fast to build, uses low resources, but I'd the governing body responds to bug reports saying "well don't do it then" or "user error" its adoption is not likely to happen.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 7 points 4 days ago

    It's very fast to load in the browser and lightweight in the backend too, without sacrificing much functionality except for some fancy animations.

    Personally I just hate the language syntax though 😅

  • source
  • parent
  • [–] 15 points 5 days ago (4 children)

    Installing it and creating a "Hello world" page is easy and from there the sunk cost fallacy kicks in

  • source
  • parent
  • hideshow 4 child comments
  • [–] -3 points 4 days ago (3 children)

    Yep. PHP stands for Perl Home Page. Perl is awful to debug and maintain.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 15 points 4 days ago (2 children)

    One of these two statements are correct

  • source
  • parent
  • hideshow 2 child comments
  • [–] 6 points 4 days ago (2 children)

    Because as we all know, other computer languages never have had any vulnerabilities, ever

  • source
  • parent
  • hideshow 2 child comments
  • [–] [S] 10 points 5 days ago (7 children)

    Was a major vulnerability discovered?

  • source
  • parent
  • hideshow 7 child comments
  • [–] 21 points 5 days ago (5 children)
  • [–] 11 points 5 days ago* (4 children)

    The ratings seem to be overblown, however. This is nowhere near some of the vulnerabilities people have compared it to, like heartbleed or log4shell

  • source
  • parent
  • hideshow 4 child comments
  • [–] 12 points 5 days ago (3 children)

    The leaked info incorrectly called it a 10 so people are acting like a 10. But an unauthenticated RCE is always a big issue.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 13 points 5 days ago* (2 children)

    It's an unauthenticated RCE in very specific circumstances under particular configurations. We haven't even seen functional exploits in the wild yet.

    edit: more info (albeit from a single researcher) here: https://eliastaylor.com/noexploit/

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 5 days ago

    The fact that I haven't heard of any major webservice involuntary taken over so far makes me increasingly skeptical, though I can also attribute it to preemptive action, partially. I presume an exploit chain might come in concert with some other insecure configurations or some malware developed eventually, but it wouldn't be the first CVE with inflated scores in recent years.

  • source
  • parent
  • [–] 4 points 5 days ago (2 children)

    wait, didn't the patches finish?

  • source
  • parent
  • hideshow 2 child comments