Ask HN: Why do people believe “PHP developer” means security ignorance?

Re:Ask HN: Why do people believe “PHP developer” means secur... by debacle on Monday November 17, 2014 @09:46AM (#8618366)

Like it or not, a cross-sample of PHP developers will have more bad programmers than possibly any other language (barring ColdFusion, Flash, and ASP, possibly).

Our good developers are just as good as the good developers in Python or Ruby or JavaScript, but we have enough bad developers to keep the guys at Soylent fed for a long, long time.

Edit: It also doesn't help that two of the biggest PHP projects are Drupal and WordPress, two pieces of software with atrocious security records.

[ Parent | on HN ]

Re:Ask HN: Why do people believe “PHP developer” means secur... by sarciszewski on Monday November 17, 2014 @10:10AM (#8618478)

Is WordPress's record really that bad? Most of the vulns I hear about come from shoddy plugins, not WP itself.

[ Parent | on HN ]

Re:Ask HN: Why do people believe “PHP developer” means secur... by debacle on Monday November 17, 2014 @10:16AM (#8618510)

WordPress core for a long time was very vulnerable, probably still has vulnerabilities, and if you're running even a slightly out of date version of the software (which might be a requirement if you've made a lot of customizations or are using a plugin that is no longer supported), you are likely vulnerable and it is almost trivial to identify that you're running WordPress and your WordPress version.

Experience has taught me that no one is going to make a distinction between WP core and a third party plugin when they could instead shit on PHP and PHP programmers.

[ Parent | on HN ]

Re:Ask HN: Why do people believe “PHP developer” means secur... by sarciszewski on Monday November 17, 2014 @10:20AM (#8618535)

Heh. Well, I'm going to be contributing to the WP core soon (making their auto-updater use openssl_verify), I'll fix anything I find there.

The worst thing I spotted when I was looking through it in June was a lack of a CS in their PRNG. I don't consider md5(uniqid(mt_rand())) adequate; urandom or bust :)

[ Parent | on HN ]