How come PHP seems so much faster than Rust?

Re:How come PHP seems so much faster than Rust? by meritt on Saturday September 28, 2019 @09:17PM (#21104328)

Your argument is a form of survivorship bias. You're not acknowledging all of the gaping security flaws in contemporary web-development frameworks. People were writing sloppy PHP before CSRF and XSS were even invented. Yet somehow, Python, Ruby and NodeJS have all had numerous CVEs despite those attack vectors being well known at the time a given framework was written.

You think SQLi was bad? You should spend some time thinking about the numerous attack vectors available today in nearly every GraphQL implementation where programmers can't move fast enough in adding it to their stack. Data exfiltration is no longer a flaw but a feature.

[ Parent | on HN ]

Re:How come PHP seems so much faster than Rust? by Avamander on Saturday September 28, 2019 @10:23PM (#21104609)

> People were writing sloppy PHP before CSRF and XSS were even invented.

It is very very easy to write sloppy PHP, definitely easier than in many other languages and default frameworks.

> You're not acknowledging all of the gaping security flaws in contemporary web-development frameworks. P

I'm very aware of them, basically none have (had) as many high-impact vulns as PHP-based stuff does.

> Yet somehow, Python, Ruby and NodeJS have all had numerous CVEs despite those attack vectors being well known at the time a given framework was written.

You're not acknowledging the orders of magnitudes difference between the impact of an usual PHP vuln and those you listed.

> You think SQLi was bad? You should spend some time thinking about the numerous attack vectors available today in nearly every GraphQL implementation

The flaws in others are a very poor excuse for flaws in a thing itself.

[ Parent | on HN ]