On Wed, 6 Jan 2010, MJ Ray wrote:

> Thomas Krichel <[log in to unmask]> wrote:
>> Joe Hourcle writes
>>> ps. yes, I could've used this response as an opportunity to bash
>>> PHP ... and I didn't, because they might be learning PHP to
>>> migrate it to something else.
>>
>> controversial ;-)
>>
>> what's the problem(s) with PHP?
>
> Oh please don't nuke the list from orbit like that! I hope that
> this is a balanced enough reply to keep everyone happy:
>
> Our experience is that PHP hosting environments vary much more, most
> PHP code is a mess (PHP-based software was part of 35% of the
> U.S. government's National Vulnerability Database in 2008 -
> http://www.coelho.net/php_cve.html) and few things (code and hosting)
> move between the different major versions smoothly. It's a "personal
> home page" tool which has grown massively, for better or worse.
>
> BUT! Even after all that, software.coop still supports some PHP
> applications because they can work well and be very useful, though
> we're under no illusions about PHP's warts.

I can sum it up in one sentance:

  PHP makes it *very* easy to write insecure programs.

Of the security incidents in our department (the ones where men with guns
come and take your hard drive and/or whole server away for an
'investigaton'), PHP has been responsible for the majority of the
incidents.

Part of it is the perceived simplicity -- look at how easy it is to add
some extra functionality to your website! You don't even need to
understand good programming practices! Anyone can do it!

(to be fair -- Perl used to be the software that fell into this niche 10
years ago, but I blame Matt's Script Archive more than the language
itself, as Perl isn't specifically for web site automation)

... and they never get their code reviewed by one of the professional
programmers in our department, it goes live, and then, a year or so later,
someone shows up to take our server because the security monitoring showed
that it looks like someone managed to pull our password file off the
system. (never mind that (1) there's a shadow file, so /etc/passwd has no
passwords in it, and (2) even if they got the password file, it only has
the application users (none of whom have login privs) because it's macosx)

Then you waste a week of your time trying to convince the security gestapo
that yes, there was a security vulnerability, and there was an incident,
but nothing confidential was actually lost ... and then we get everyone
who had stuff on the server bitching us out because they can't get to
their stuff, and they had some time-sensitive information to get out, or
whatever, and we're trying to jump through security's hoops for a week or
two while our other projects get further and further behind.

...

Now, if they actually manage to *upload* a file to your system ... then
expect to rebuild your whole machine from the ground up.

so um ... if you're going to use PHP ... if you're on apache, look into
suPHP. Consider making your website served from a read-only file system,
and look online for other tips on hardening your server.


-Joe


oh, and I also really disike having to tye all of my stuff to one
database. I know mysqli makes it better, but the original mysql stuff
still taints my perception of PHP.

I also have a dislike of ColdFusion servers, but that stems from the 'unix
registry' crap they used (still use?) back when they were still Allaire,
and I had a few times when the system choked and I had to rebuild all
settings from memory the first time, and from printouts of the server
configuration the next few times. And then there was the time at a
previous job when we upgraded the server and they pushed in changes that
made the service crash every night at about 2am ... so I'd get a call
every night to restart the thing ... until I finally wrote a watchdog
script which by the time I got fired, was restarting the service 5-8 times
per night ... but I actually *liked* coldfusion as a developer.

...

and so long as we're mentioning PHP, and this is code4lib -- anyone
personally know the developer of refbase? I tried emailing him a few
months back offering patches to get rid of all of the 'deprecated'
warnings when running under php5.