News for hackers. Stuff that matters.
Re:We spent $20 to achieve RCE and accidentally became the a... by dpcx on Wednesday September 11, 2024 @08:36AM (#41510763)
I'm curious about some specifics of why you wouldn't use PHP for _critical_ web infrastructure?
Re:We spent $20 to achieve RCE and accidentally became the a... by sebstefan on Wednesday September 11, 2024 @08:45AM (#41510814)
https://duckduckgo.com/?q=hash+site:reddit.com/r/lolphp

https://duckduckgo.com/?q=crypt+site:reddit.com/r/lolphp

>crc32($str) and hash("crc32",$str) use different algorithms ..

>Password_verify() always returns true with some hash

>md5('240610708') == md5('QNKCDZO')

>crypt() on failure: return <13 characters of garbage

> strcmp() will return 0 on error, can be used to bypass authentication

> crc32 produces a negative signed int on 32bit machines but positive on 64bit mahines

>5.3.7 Fails unit test, released anyway

The takeaway from these titles is not the problems themselves but the pattern of failure and the issue of trusting the tool itself. Other than that if you've used php enough yourself you will absolutely find frustration in the standard library

If you're looking for something more exhaustive there's the certified hood classic "PHP: A fractal of bad design" article as well that goes through ~~300+~~ 269 problems the language had and/or still has.

https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/

Though most of it has been fixed since 2012, there's only so much you can do before the good programmers in your community (and job market) just leave the language. What's left is what's left.

Re:We spent $20 to achieve RCE and accidentally became the a... by rty32 on Wednesday September 11, 2024 @09:47AM (#41511340)
People keep saying "oh it's php 5.3 and before that are bad, things are much better now", but ...