This is an extremely unproductive comment that has nothing to do with the article.

I know nothing about individual readers' knowledge. However, when addressing the general audience (programmers and in particular PHP developers), I've seen enough projects (both open source and proprietary) that attempted to provide public key encryption to have an idea of the average developer's competence here.

For example, this library for integrating with a payment gateway: https://github.com/pagarme/pagarme-php/issues/29

There are people who can do public key encryption in PHP safely†, but when left to their own devices most people will not. Thus, the headline.

† I would go as far as to claim the global population of full-time PHP developers who can securely implement public key encryption in PHP without outsourcing to libsodium is less than 10.

Do all 10 work at your company, or are the remaining 9 employed elsewhere?

You get called out for using clickbait headlines, and then double down by stating an absurd and baseless opinion. Not a good look, man. Decide what you want; to share insights and information or gain attention.

> Do all 10 work at your company, or are the remaining 9 employed elsewhere?

I'm only aware of one other person who fits the criteria I've stated (many others would if I loosened the "work with PHP full time" restriction).

> You get called out for using clickbait headlines, and then double down by stating an absurd and baseless opinion.

Absurd and baseless?

There are probably very few security researchers that have looked at more application-layer cryptography features than I have, especially those written in PHP. If you know of any: Ask them if they believe my assessment of the PHP community is wrong.

https://paragonie.com/security/advisories

https://github.com/issues?utf8=%E2%9C%93&q=author%3Aparagoni...

You're free to dislike the headline. I've got nothing to say in defense of it.

> You're free to dislike the headline. I've got nothing to say in defense of it

Please don't use such headlines on HN. As this thread demonstrates, they derange discussion.

OK, I thought the "use the original headline" rule was stricter but just reread the guidelines and saw that I was wrong.

Well, you wrote the headline, so I think the real recommendation here is to avoid cutesy headlines.

Nobody is assaulting your ego; you're doing that to yourself. I'm not doubting your experience or knowledge, and I appreciate that you're driven to share it. I can see that you genuinely care, and that your intent is most likely virtuous.

I am, however, suspicious of your approach to and style of communication; as are others. Generating attention is the not the same as interest, man.

It's baseless because you can't quantify how many full time PHP devs there are in the world outside of your own acquaintance. That's not enough information to lend your statements any validity. You can stand on your own merits without trashing everybody you don't know.

> You can stand on your own merits without trashing everybody you don't know.

I think I see the problem here.

You're parsing my statements as a sort of attack on others.

Let's try this: The global population of full-time PHP developers who are qualified to perform brain surgery is probably less than 10.

Is that statement less controversial?

Understanding cryptography isn't exactly a requirement for being a successful PHP developer. Additionally, the folks who do know cryptography very rarely find themselves working on PHP full-time: There's too much industry demand in other areas.

That most developers who work on PHP full-time do not have this particular skillset is NOT an attack on most developers. It's simply an observation and a reasonable consequence of the absence of market pressures.

Also, it's a difficult subject.

Feel free to find out who CiPHPerCoder is before you throw insults ;-)