Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:58444
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <A633CF2D7C7BED41B41F1E64F25507B8069DC46E57@MAILR001.mail.lan>
References: <CAG=uTXEfTBqX7n0_zfGjB_txQFKtZXF4MOo6RHHPSRPerGeKZA@mail.gmail.com>
	<CAKOpQSyxDDqiaXQbVZHE-5K_hOS8dOx4g6Bsj+yJ9BjmTOMh8Q@mail.gmail.com>
	<693e15008681dfe7372eaea66214f8a8.squirrel@www.l-i-e.com>
	<CAKOpQSxh78xMqm=aQ1jBx1T4VJ-BfKHQkxha4B=mHe6TAeiQGw@mail.gmail.com>
	<A633CF2D7C7BED41B41F1E64F25507B8069DC46CEF@MAILR001.mail.lan>
	<CAKOpQSyyXfuCmcx63EgoQa-pkUxT+STS=TNOJvTQ1JEwG=VKow@mail.gmail.com>
	<4F4D5D44.5090307@developersdesk.com>
	<CAGovj_MuUqMaVb_dPTNvTPkD3BcNPGkx88i5uQbbVe=j+dGA8Q@mail.gmail.com>
	<CAKOpQSx0mgixv3DA8FS0hL5QNb-8p5v6u=jYQ5d7HRuAVr6P1Q@mail.gmail.com>
	<de418e115ec35d6471a9143753be164a.squirrel@www.l-i-e.com>
	<CAKOpQSx56j=TFnbcbxJvW5-jPBAHyBXs=RK87rN9pU+gXssNfg@mail.gmail.com>
	<A633CF2D7C7BED41B41F1E64F25507B8069DC46DC0@MAILR001.mail.lan>
	<f7238224c6b990a4930011352aa897c3.squirrel@www.l-i-e.com>
	<CAKOpQSxATsTfetZa87WaeTN8BjOCDXYOhJ8Tcr2eGW5NJ7+TYg@mail.gmail.com>
	<A633CF2D7C7BED41B41F1E64F25507B8069DC46DC5@MAILR001.mail.lan>
	<c5e881836e676df9f75afff4a14536de.squirrel@www.l-i-e.com>
	<A633CF2D7C7BED41B41F1E64F25507B8069DC46E57@MAILR001.mail.lan>
Date: Thu, 1 Mar 2012 17:22:25 -0800
Message-ID: <CAKOpQSxNUXdRgoUXkc5FhmXFcc_0CD-ZD151k_WDiqDaRfXTLA@mail.gmail.com>
To: John Crenshaw <johncrenshaw@priacta.com>
Cc: Richard Lynch <ceo@l-i-e.com>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=f46d043be1c6c4364904ba386815
Subject: Re: [PHP-DEV] PHP Philosophy (was RE: [PHP-DEV] Scalar type hinting)
From: kris.craig@gmail.com (Kris Craig)

--f46d043be1c6c4364904ba386815
Content-Type: text/plain; charset=ISO-8859-1

I agree with what John said.  Limiting the scope to scalars, while having
some advantages, probably wouldn't pass the "usefulness" test for most
people.

--Kris


On Thu, Mar 1, 2012 at 4:18 PM, John Crenshaw <johncrenshaw@priacta.com>wrote:

> From: Richard Lynch [mailto:ceo@l-i-e.com]
> > On Thu, March 1, 2012 2:38 am, John Crenshaw wrote:
> > >> You might consider those scripts poor programming practice. We all
> > >> do.
> > >> But PHP is the language of the unwashed masses, and that was, and is,
> > >> part of why it is hugely popular. Somebody who barely understands
> > >> programming can pound away at the keyboard and write a bloody useful
> > >> web application, breaking 10,000 Computer Science rules along the
> > >> way.
> > >
> > > And in 20 minutes I can hack into that application 20 different ways.
> > > This isn't really PHP's fault...or is it? By deliberately catering to
> > > the lowest possible denominator is it possible that PHP itself
> > > contributes to the proliferation of wildly insecure web sites? I do
> > > understand the "unwashed masses" argument, and yet, the security geek
> > > in me sometimes questions how "good" this is.
> > >
> > > (Before someone flames me, I'm not really saying that we should scrap
> > > any foundational principles or tell basic users to go hang themselves.
> > > This is mostly philosophical musing.)
> >
> > We make concerted efforts to educate scripters, by posting the same
> thing in all our blogs.
> >
> > Even if all they understand is "Don't do this!" it's good enough for
> most of them.
> >
> > Other times the decision was made to just deprecate a "feature" and
> provide a migration path,
> > if suitable, but spread out over major
> > releases:
> > PHP x.0: Feature is bad, but there
> > PHP x+1.0 Feature is E_DEPRECATED (or documented as such before E_DEP)
> [This is the bit
> > where a LOT of scripted edumacation has to happen.) PHP x+2.0 Feature is
> just gone.
> >
> > People who completely ignore docs or don't upgrade remain vulnerable,
> but there's not much
> > you can do without making life miserable for a bazillion developers.
>
> No, you've misunderstood. The average new not-really-a-developer has no
> concept of security. Every SQL query they write is vulnerable to injection.
> Every echo exposes their site to XSS vulnerabilities. Every form is
> vulnerable to CSRF. If they did anything with files in their script I may
> be able to read arbitrary files to their server and/or upload and execute
> arbitrary scripts. If they used eval() or system() I can probably execute
> arbitrary shell code and take control of the entire site. If their server
> is badly configured I could capture the entire machine.
>
> This isn't a question of keeping software updated and not using deprecated
> functions, this is a question of discipline that is completely missing
> among the "unwashed masses" as you call them. The intuitive way to handle
> many of the most common PHP tasks is also the completely insecure way.
> Philosophically, I wonder if we do a great disservice by encouraging these
> people to tinker with code at all. We do so knowing (or at least we should
> know) that anything they create will inevitably be hacked. We fuel the
> widespread security problems that currently plague the web.
>
> John Crenshaw
> Priacta, Inc.
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

--f46d043be1c6c4364904ba386815--