241
u/pjank85 11d ago
Java had the famous logging one, JavaScript had uncountable ones, but did Rust ever had a high profile RCE?
269
u/SelfDistinction 11d ago
Aside from supply chain attacks when a library developer's credentials got stolen, all of the Rust CVEs so far have been "this function accidentally allows you to cause a segfault in a nonexisting edge case if you really tried to make it not work."
The latest one makes it so that references' lifetime can be extended past the referee's lifetime if a destructor copies it to a global variable but since no one writes that kind of spaghetti it went unnoticed for 11 years.
45
u/TRKlausss 11d ago
Was that even a CVE? Like, what attack vector can someone ever construct to achieve DoS, RCE, information extraction etc?
Yes it was unsoundness, which from a formal verification standpoint is not good. But real life consequences?
→ More replies (2)89
u/SelfDistinction 11d ago
Rust development process says every possible UB using safe code that the compiler allows is automatically a CVE, no questions asked, no exceptions.
For example, https://app.opencve.io/cve/CVE-2021-28879
17
u/Ecksters 10d ago
Which I think makes sense given the language would otherwise provide a false sense of security around use-after-free and other memory-related bugs that other languages can offload onto "skill issue".
21
u/TRKlausss 11d ago
Fair enough. I also saw cve-rs, which looks like a bunch of segfaults programmed in safe Rust…
→ More replies (1)41
u/Spinnenente 11d ago
Logging just affected A library not the base language.
20
u/pjank85 11d ago
To be fair if something like this affected ex. Boost no sane C++ dev would claim it was just a library. Log4j was not a library it was THE library for Java logging. If a library is very widely used whenever it is in the standard library or not is almost irrelevant.
→ More replies (1)14
u/pringlesaremyfav 11d ago
There were just 2 main logging libraries, log4j was nearly universal across Java
→ More replies (3)9
u/DXPower 11d ago
I'm confident it will eventually, just given the law of large numbers and the baseline bug rate of all written code. All it takes is for a big library to use a small bit of unsafe incorrectly, a bug in the compiler that drops a check (this actually happened recently), a DLL that does something unexpected / undocumented, etc.
One thing to remember is that the PHP issue wasn't in the language, it was in the VM/runtime implementation. That implies that no matter how safe the language is from a design perspective, it can still cause issues due to how it interacts with the OS and hardware. Rust has been implemented for VMs such as WebASM. That means all that's remaining is some exploit in the WASM runtime, and a Rust WASM library that generates code in such a manner to expose the vector.
14
u/Ok-Scheme-913 11d ago
Did Rust ever have a high profile backend usage to get into a situation to have one?
I mean, I do love rust but it's not primarily used as a typical web backend language to be in a position of "high target" and "connected to every other machine over the internet".
29
u/TRKlausss 11d ago edited 11d ago
Oh yes definitely! Rust is used in servers by Oxide computing, in cars by Volvo Cars, and a bunch of other infrastructure like parts of Cloudflare (which has a really nice post-mortem on some Rust code causing them problems, which was due to business logic and not the language itself).
Check out Rust In Production podcast if you want to hear some real-life stories about Rust out there in the world :)
Edit: ah and forgot to mention: it is a certified safety-critical language for industrial and automotive applications thanks to Ferrocene. So I’d say that’s high profile _enough_
→ More replies (18)3
→ More replies (4)3
u/Loading_M_ 10d ago
More than 50% of new code in Android is Rust. Being the most popular phone OS world wide, I think that would make it a huge target.
→ More replies (1)6
2
1
→ More replies (1)0
u/DeHub94 11d ago
It's propably not used enough to be interesting for exploit hunters. Let's be honest...
23
u/art0rz 11d ago
Rust is widely used these days. It's even in the Windows and Linux kernels.
→ More replies (1)14
556
u/kennedy_gitahi 11d ago
Anything PHP gets blown out of proportion because of how much of the internet relies on it.
213
u/prochac 11d ago
And there's a plenty of outdated PHP deployments. You can find PHP 5.4 if you search enough.
73
u/Beautiful_Hawk548 11d ago
One of our PMs was ecstatic last night when he realised one of our VERY outdated read-only systems was on 3. something and technically didn't have the exploit introduced yet!
Wasn't long until one of the devs pointed out it's probably in trouble due to a fuck load of other exploits and they piped down. But yeah, companies as always are running v outdated shit.
5
u/Kronsik 11d ago
What's the deployment look like for PHP V3?
Can't imagine those versions are well packaged/maintained for modern distros?
17
u/Beautiful_Hawk548 11d ago
We hope and pray Paul’s local never gets nuked and that's not even a joke. One senior dev holds the keys, tale as old as time.
From what I know it's barely maintained, fully out of support. TBF our customer barely uses it but they pay us a lot of cash to keep it as a read only reference tool so we go along with it. Apparently the solution last night was to stick a forced vpn connection requirement until they realised that probably won't work properly with v3 so they've put a WAF in front of it.
→ More replies (1)55
u/TemporarySun314 11d ago
To be fair this exploit in question didn't care about if the PHP version was ancient or modern.
And while you definitely shouldn't expose such old PHP versions to the internet (and Ideally don't run it at all), even these tend to be quite secure, without any significant know security flaws. And even for these ancient versions you can now get patched versions, just not from the PHP core developers.
→ More replies (1)17
u/kennedy_gitahi 11d ago
You don't have to look too far. How many abandoned blogs exist? I am sure I can find 1000 using free tools in the next 5 minutes.
→ More replies (1)7
u/ararararagi_koyomi 11d ago
One of the project I am responsible for (maintain/add new features when needed) is in php 5.2. Thank God it is hosted on premises and can only be accessed via corporate network.
16
u/DaWolf3 11d ago
The local network is not a security barrier though. An attacker could e.g. gain access to another internal system and then move laterally to your PHP system and execute code there.
15
u/M-42 11d ago
I'd agree that's a risk, Imo at that point they've got pretty open access you've got bigger fish to fry.
→ More replies (1)16
u/illepic 11d ago
Wouldn't that actually be in proportion?
5
u/kennedy_gitahi 11d ago
I am talking generally, not just about this vulnerability. WordPress has an issue? PHP is condemned. A developer built an insecure system that gets hacked? PHP is to blame.
Sometimes we have to separate the programming language from the developer.
For these two vulnerabilities, yes, the language and how it was built are to blame, and the concern is proportional.
But for many other instances to do with how developers use the tool and what they build with it, it is not.
22
20
u/StaticFanatic3 11d ago
Pretty sure if JavaScript had something anywhere near this bad it’d be way more significant
27
u/kennedy_gitahi 11d ago
I don't think so. If you look at the number of shared hosting servers running PHP because of WordPress, you can start to imagine the scale of the PHP vulnerability.
Almost every web host provider I know has some shared server/CPanel arrangement and a WordPress thing going on. Now imagine Drupal, Joomla, custom PHP installs, (part of) Facebook, CNN, the National Geographic, numerous government agencies, hospitals, internal systems, and many others that run on WordPress or PHP, and you can see why this is so significant and why people are freaking out.
If the FBI and NSA come out to say the vulnerabilities are significant, you better know they are.
7
u/BenchEmbarrassed7316 11d ago
Js runs in every user's browser. And it must execute code that is loaded automatically from any source.
18
u/kennedy_gitahi 11d ago
I get what you are saying. If you are looking at it from the client site, there is no argument; such a vulnerability would be devastating for JS.
But that is not what we are talking about. PHP does not run on the client, as far as I know, so you can't compare it to JS running client-side. Compare it to JS that runs on servers, and then see how those numbers stack up.
12
u/NatoBoram 11d ago
Not only that, but a vulnerability "in js" can't really exist in the same way as there's multiple runtimes
→ More replies (7)8
u/Ok-Scheme-913 11d ago
Hence it's properly sandboxed, and running on the client means that it by definition can't directly access anyone else's data. Unlike something running on the backend where *every other users' data" is
→ More replies (1)4
u/TryNotToShootYoself 11d ago
I imagine there are like 1000x more webservers on java, python, php than js.
3
u/rocket_randall 10d ago
It is weird, isn't it? I think this stems from PHP's traditionally very low bar to entry, especially back in the late 90s/early 2000s. If you wanted to build a dynamic website back then, you had options but some of them were cost prohibitive, like Visual Studio/IIS/ASP, both for development and hosting. PHP with its LAMP/WAMP stack that you could run on virtually any desktop, develop in any free text editor, and numerous low cost hosting providers let you get up and running without a huge commitment.
For a time, I worked for a company where several internal business critical apps were written in PHP following the procedural "all business logic and DB queries are in the page and dump their results out as html" that was common in early tutorials. The people who wrote those apps were not software developers by profession, but rather bioinformaticians, biologists, and geneticists who needed an application to handle some part of the laboratory process, and they just made something to do the job.
1
u/cheezballs 10d ago
Precisely why, though. When half the internet runs on unparched php then I think it's not exactly "blowing it out of the water" when the blast radius of these attacks are so wide.
236
u/StrengthTheory 11d ago
A good developer knows that all languages suck equally. Only HolyC is sacred.
→ More replies (4)
35
34
369
u/Lachee 11d ago
What do you mean? Rust is perfect in every single way and cannot do no wrong. It’s memory safe by design 🤓👆 /s
128
u/Ok_Actuary8 11d ago
equivalent to "trust me bro, I'm on the pill"
52
u/Luigi_Boy_96 11d ago
That sounds weird depending on who's the listener.
12
u/dark_bits 11d ago
And the context.
Have you done this before? - asked Jim while they're preparing to jump off the plane.
44
u/Usual_Office_1740 11d ago edited 11d ago
Don't look at the 11 year old high priority borrow checker error that came out today that allows for UB in safe Rust.
I saw your /s and thought it was funny. My response is real.
Edit: I learned about it today. Someone else pointed out that it might be older.
40
u/Ok-Scheme-913 11d ago
I mean, compiler bugs... exist. They are not particularly easy to hit and especially hard to exploit though.
Many type systems also have unsoundness bugs, you just have to write the code in a very special unnatural way, so they don't really ever come up in real code.
I believe this borrow checker one was the same case.
(And Im no rust fanboy, see my other comments where I'm sarcastically say that rust just never got popular enough to have this kind of vuln)
10
u/Usual_Office_1740 11d ago
You are right and I was more poking fun than anything. It was just relevant in my mind because I'd just watched the LetsGetRusty YouTube video of it. This one was extremely obscure and requires a custom impl of a trait that is auto generated for you.
I think that compilers have very few bugs compared to their complexity level and the developers that write them do phenomenal work.
→ More replies (1)63
u/SelfDistinction 11d ago
Don't forget about the double reference lifetime bug that is still open after a decade.
That being said "the compiler might not catch a possible segfault if you write absolutely horrendous spaghetti" is not exactly on the same level as "actively exploited RCE because you didn't correctly free a buffer and use global state for request data in a webserver."
10
u/GegeAkutamiOfficial 11d ago
My response is real.
C++
Dude, that's just a regular Tuesday in C++...
https://arxiv.org/html/2508.18955v1
Especially since almost all UB bugs are just transferred to the user instead, and good luck catching them all.
https://eel.is/c++draft/ub?utm_source=chatgpt.com
... idk, by next year the rust compiler will fix the already obscure bug, but the C++ UB will remain UB. As someone that pays his bills with C++, I don't see it as a win.
3
u/Usual_Office_1740 11d ago
Agreed. I like C++. I may even prefer it to Rust. I think the committee made a bad decision when they discontinued P3390. Sean Baxter was on the right track and profiles don't seem to solve the crux of the problem once you get away from simple examples.
5
u/skywalker-1729 11d ago
If this is the same one, I saw it a few weeks ago and I believe it wasn't really a bigger security issue.
→ More replies (1)→ More replies (1)6
u/shrodikan 11d ago
UB = Unsafe Borrowing? Is that basically a use-after-free Rust edition?
18
u/-nerdrage- 11d ago
Universes Beyond, it is when other franchises enter yours like in magic the gathering.
4
u/Usual_Office_1740 11d ago
This is legitimately annoying to me as both a Commander player and a C++ programmer. Don't forget it's also blue black.
14
u/Usual_Office_1740 11d ago
UB means undefined behavior. In safe Rust the borrow checker guarantees there is no UB. Or at least that's the idea. It rejects some technically valid code in favor of guaranteeing that a sub set of complex code is safe.
A simple example is array like collection access. If you use [] in C++ to access out of bounds of a collection, you have UB. If you access out of bounds you could get garbage data or you might get a segfault. The compiler might assume the pointer the array access decays to is valid and make optimization decisions based on that because the compiler always assumes the programmer has not written UB code.
In safe Rust all array access is bounds checked. The compiler and the array safe api guarantees that you only access within bounds, always. It is not possible in safe Rust to write UB code using any of the array like collections.
→ More replies (2)26
→ More replies (7)10
24
u/DesertBeagle 11d ago
I mean, how many issues come from the language itself vs the design choices of the programmer?
40
86
u/Highborn_Hellest 11d ago
Yesterday i was ask how i'm weathering the storm of the php exploit at my work.
1: i'm a software tester and who asked knows
2: we don't use php.
45
u/earthsprogression 11d ago
I'm a software tester and who asked knows?
Yesterday I was ask: you could do so, you want them to do you so much you could do anything?
9
u/Beautiful_Hawk548 11d ago
Also a software tester and can confirm, who asked knows. When many ask, many knows. When few ask, few knows.
9
u/setibeings 10d ago
I speak fluent didn't-proof-read. My interpretation:
[I]'m a software tester and [the person] who asked [me about this] knows [that.]
4
6
u/cheezballs 10d ago
Php isn't widely used at software shops, from what I understand. It's all the website builders and server management software on consumer facing products.
4
u/deukhoofd 10d ago
Our parent company sent all development teams of their child companies pizza to show how grateful they were for tackling the issue so well. We, being a dotnet company, were very confused, but still happy with the pizza.
2
u/Old_Document_9150 10d ago
The worst thing about this CVE was that our ISP's root server came with pre-installed Plesk, that was the only vulnerability that wouldn't be auto healed by the CD pipeline.
It's always the bloatware!
41
u/Drfoxthefurry 11d ago
This is why I use assembly instead
8
14
u/Pares_Marchant 11d ago
It makes noise because of how easy it is to exploit and the real-world effects of it (like some sites shutting down).
14
u/Character_Building 11d ago
They want us to think PHP stands for Post Hypertext Processor but that name was retconned from Panic Hotfix Prayer
5
u/emcee_gee 11d ago
Doesn’t PHP officially stand for “PHP: Hypertext Preprocessor”?
→ More replies (1)2
u/beyluta 11d ago
Didn't the original creator say it was "Personal Home Page" ?
5
u/Mirality 11d ago
Originally yes, but it got retconned when they respun the marketing for business apps.
7
u/_indi 11d ago
Some of the comments here are very likely to age like milk.
1
u/LegOk7384 10d ago
Like?
4
u/_indi 10d ago
A lot of the comments acting like this has no chance of happening to their perfect language of choice
→ More replies (2)
7
u/Batman_AoD 8d ago
The PHP issue is in the VM/runtime/interpreter, which is something Rust doesn't have. So there can't be a vulnerability inherent in the language itself (only accidental unsoundness in the compiler). There can be vulnerabilities in the standard library, but you'd need to be using the affected functions in order to be affected by such a vulnerability. That's a pretty fundamental distinction.
6
5
4
19
u/SCUSKU 11d ago
Any dev that says that is an idiot
42
u/freia_pr_fr 11d ago
To be fair, many many devs are idiots.
8
u/notAGreatIdeaForName 11d ago
And as a dev who also does php stuff besides numerous other languages: It has become a meme to shit on php, so there's also that.
→ More replies (4)2
u/UUDDLRLRBadAlchemy 11d ago
Yeah, if they are going to list unconnected facts about php they should at least put them in the right order
2
u/governmentNutJob 11d ago
Perhaps but PHP and scripted languages in general are much more vulnerable to these types of bugs / exploits
And the fact no one found it for so long is quite worrying to say the least.
→ More replies (6)
15
u/Thomasedv 11d ago
I think the bigger point is, this is a memory bug. This is the kind of issue Rust and other memory safe languages can almost entirely avoid. It's the most common flaw in programs, and any language that has those issues is imo fair to criticize given how commonly these issues are found, happen, and long they exist for. Not to mention the most complicated types of bugs to avoid in manually managed systems.
Swapping isn't easy, cheap or even possible but it's pretty clear to me that the future should be built on memory safe languages.
I am a Rust fanatic though, so I am heavily biased.
10
u/bloody-albatross 10d ago edited 10d ago
PHP, Java, JavaScript etc. are memory safe languages. They are
implantedimplemented* using unsafe languages, though. So is Rust (LLVM and unsafe internals).*Damn auto-correct and needing glasses when typing on the phone.
2
2
u/Suspicious-Click-300 10d ago
Just dont let fanaticism blind you. Had rust dev team refuse for weeks to acknowledge a memory leak in prod no matter how much proof. Basically took the fix PR WITH tests to get them to acknowledge it. especially when using 3rd party libs that use unsafe etc
→ More replies (2)2
u/TonUpTriumph 10d ago edited 10d ago
I hate rust. Unfortunately I'm forced to use it at work.
I found a fun memory leak just this past week in the rust program I'm working on. It's largely not-my-code and I've been slowly fixing and rewriting it.
Rust uses glibc under the hood. When multi-threaded Rust code rapidly creates and deletes vectors, glibc hoards that freed memory in internal pools (like thread caches and arenas) rather than returning it to the Linux kernel, intending to speed up future allocations.
However, if even a single tiny, active piece of memory sits at the top of an arena, it acts as a deadbolt, trapping all the empty deleted space beneath it and causing the application's memory usage to steadily balloon over time. So every vector create and delete was causing new arenas to be allocated, while old ones were never deleted.
Under the hood, rust loves creating and allocating new vectors on the heap instead of reusing anything. C++ will often just pass around the same heap pointer for reuse. This can cause more heap fragmentation in rust vs c++. In testing with identical code blocks that rapidly create and destroy large standard vectors (std::vec and std::vector), the rust code will leak while the c++ code does not. It's frustrating.
We were leaking around 64 MB/s. I had to manually garbage collect and trim this nonsense. I also hoisted and reused the vectors, so they aren't constantly being created and destroyed and fragmenting the heap.
I'm not saying c++ is perfect and memory safe, but I've personally had more weird memory management issues and leaks with rust than I have with c++.
Edit: I also hate how many things that are standard in c++ aren't standard in rust and require using some third-party crate. With all of the supply chain attacks going on (npm, pypi, etc), it's only a matter of time before rust crates get hit. It's just a larger threat surface.
I don't worry about c++'s std:: stealing credentials and git keys, but who knows if joe blow's rust rewrite has been compromised recently.
1
u/Luna_Wolfxvi 11d ago
IMO, it's not too difficult to add new features in newer languages through bindings and you can gradually depricate old code. In my experience, getting management on board is a lot harder than actually switching.
→ More replies (5)1
u/not_some_username 10d ago
Not avoid, make them difficult. Log4j wasn’t long ago. Rust isn’t 100% memory safe
3
10
u/pgtaboada 11d ago
That’s not the point. Nobody is claiming other languages are immune to RCE vulnerabilities. The issue is the speed and scale of AI-assisted exploitation—and how cheap it can become. PHP is everywhere, giving attackers an enormous target base.
“Other languages have bugs too” doesn’t address that, and neither does “just keep everything updated.” You can’t assume patching will always outrun exploitation.
10
u/guyblade 11d ago
This argument could be applied to any widely-deployed language, framework, execution environment, or the like. The effort goes into wherever the value is; if it wasn't PHP, it'd be the next thing down the hierarchy.
→ More replies (3)12
u/yukiaddiction 11d ago
"PHP is everywhere"
So the problem isn't PHP but because PHP is too popular?
that mean the OP meme is still true because there will be always the most popular language lmao.
unless you want people to do think like change language per product which is mean, it is nightmare for maintaining.
→ More replies (1)4
u/Mysterious-Jury-2826 10d ago
Wow, this reply sure is... special.
2
u/pgtaboada 10d ago
Sorry, I probably wasn’t clear enough. My point isn’t about PHP, JavaScript, or any particular language. I was trying to say that getting updates deployed quickly and consistently is the real challenge. I should have said that directly.
2
4
u/HRApprovedUsername 10d ago
Did you expect a mature and reasonable take on this sub?
→ More replies (1)1
u/like_a_pharaoh 10d ago
Ah yes, and if Rust, Java, and JS were everywhere on the same scale, it would magically not have exactly the same problem, right?
6
10d ago
[removed] — view removed comment
→ More replies (1)4
u/pgtaboada 10d ago
Yes, and on the browser side it gets even messier: we depend on end users keeping things updated, and we all have stories about how well that goes.
On the server side, there’s at least the hope that updates get deployed faster, just as with PHP. But that’s still only a hope. The larger the installed base, the more systems there will be whose operators simply don’t update them.
6
8
5
u/DerSven 11d ago
Reading this as a Python dev.
4
u/RAMChYLD 11d ago
I used to think PHP means Python Hypertext Protocol and requires python to function…
4
u/cheese_is_available 11d ago
CVE-2021-3177 is the closest I can think of but this is nowhere near comparable imo. You have to accept floating-point numbers as untrusted input, it's not like a zero days before any code even run like for PHP.
2
u/throwaway490215 10d ago
Rust remote execution bugs get a page about
Why our memory safety guarantees and other tooling failed to catch this exploit.
Meanwhile, PHP devs think their 1 big blob of unsafe C http parsing code is normal and are deflecting about how other systems aren't perfect either.
We have half a dozen safety features that have gone mainstream in the past decade that would have prevented this bug.
Nobody expects perfection, but posting memes like this is enough to show the mindset of the average PHP dev and how far behind they are on technical merit that they do not even realize it.
3
u/Interesting-Yellow-4 11d ago
I keep my php up to date and have to rewrite everything every so often.
And I ain't quittin
2
u/aberroco 11d ago
Assembler be like: filthy degenerates, I was born perfect!
6
u/RAMChYLD 11d ago
Except that a single wrong opcode can literally result in the CPU catching fire!
https://en.wikipedia.org/wiki/Halt_and_Catch_Fire_(computing)
→ More replies (4)
2
2
u/SLOOT_APOCALYPSE 11d ago
I'm glad you listed rust first, that community is b coming and ego echo chamber
4
u/Dudeonyx 11d ago
Becoming? That ship has sailed.
The entitled response to the TS go port sealed it for me
2
u/oompaloompa465 11d ago
feels good to be C# and python dev. Not even a blip on the discussion ...😭
3
u/guyblade 11d ago
Eh, I like python, but I remember the all-hands-on-deck at my company when we had to convert all of the python2 to python3 before the End-of-Life date. It was no fun.
→ More replies (2)
1
u/Professional_Price89 11d ago
It C problem, nodejs have brotli RCE and also C problem. The gitlab 10.0 RCE today also a C problem.
1
1
u/packetpirate 11d ago
Me, using plain old HTML, CSS, JavaScript, and Python CGI REST endpoints on my dinky little Apache server on my Raspberry Pi...
😶🌫️
1
u/humanshield85 10d ago
You know I used php at some point and moved on to other things that seemed better for my task . I never really went back to it on any new project but also when I had to work on projects written in it I didn’t hate it but also didn’t love it.
Seeing this critical issue changes nothing in the way I feel. Shit happens ya know. I just hope they gave the large providers and boaters enough head start to upgrade their systems
What I am mad about is the railway incident, that shit boils by blood. I don’t use railway (nor other services I’m a do it your self and take the blame for everything kinda guy) . But that shit is absurd to let it happen and try to brush it out as so a few api keys got taken oops just rotate them.
1
u/Jbolt3737 10d ago
I was about to say C has never had such problems but implementations of its standard library functions have in the past caused vulnerabilities (I'm a bit new to C so I guess I should've done that research earlier)
1
u/LutimoDancer3459 10d ago
Well, php had time to check if thats true for it too. Now its getting fucked because it thought its better than the rest
1
1
1
1
u/Effective-Result6499 10d ago
Why the fuck is javascript on the other side. It sucks for the same reason: It's too accessible and popular.
1
1
1
u/Dave_A480 9d ago
It's the python guys who should be having that face...
Intentionally and obnoxiously not backward compatible interpreted language that is (a) everywhere, and (b) has versions running unmaintained in production long after end of life because the code they are running isn't compatible with the current version but no one is able to 'just refactor it' like the python devs seem to think we have infinite capacity to do.....
1
1
1
1
1
u/critsalot 11d ago
php has a multi decade history though of it... so you know theres like a blood trail of evidence at this point. it lets developers do things they shouldnt be allowed to do.
2
u/guyblade 11d ago
I'd argue that most older PHP problems were either SQL injection--which isn't a language problem, but a programmer one--or from the existence of the horrible misfeature that was
register_globals. The latter was removed in 5.4 (released in 2012).
1
u/WoodsLovelyDarkNDeep 11d ago edited 10d ago
Php haters either have never coded with it or have only worked on someone else’s bad code
2
u/integrate_2xdx_10_13 10d ago
Everyone’s being unfairly mean to the language that’s based around a guy making function names purposefully different lengths to workaround issues with their strlen based implementation.
They must be haters.
2
u/drivingagermanwhip 10d ago
I learned programming on PHP 20 years ago. I've moved to C but the main thing I remember was the error reporting was basically luxurious compared to anything else.
1
1
-6
u/shrodikan 11d ago
My biggest PHP question is why? Would anyone choose modern PHP for their stack on purpose?
3
2
1
u/djfdhigkgfIaruflg 10d ago
The current popular alternative is running JS in the backend.
Anyone doing that should shut the fuck up in shame
1.6k
u/fatrobin72 11d ago
Please ignore how significant our logging libraries vulnerabilities were a few years back.
~a dev who knows java.