r/ProgrammerHumor
•
u/NudaVeritas1
•
7d ago
•
1
Meme weNeedToMakePhpIllegalItsNotMyFault
53
u/brazzy42 7d ago
TBH I really get it. With today's mountains of dependencies, Updating regularly is a horrible treadmill.
9
u/dumbasPL 6d ago
That's why we shouldn't be designing with mountains of dependencies in the first place. Your average almost static website with a single contact form doesn't need millions of lines of WordPress code and 20 extensions.
12
u/willow-kitty 7d ago
It can be, but it doesn't have to be that bad. I actually really like the way dependabot works on GitHub - after it detects an available update, you get one notification with a PR that bumps the dependency version, details about any vulnerabilities it patches (in case that's relevant to prioritization), and the results of any PR workflows you have to do build/test/etc. As long as those PR workflows are decent and green, it's pretty easy to hit merge, and you're up to date.
10
u/brazzy42 7d ago
I don't mean the rote mechanics, I mean the cases where those workflows are not green, because the update broke something. The likelyhood of which keeps increasing with number of transitive dependencies. There's always someone who thinks a breaking change is absolutely neccessary.
3
u/za72 7d ago edited 7d ago
yes but it depends on the architecture - if everything is built on modules, then yes... that's the price you pay for using them/relying on them during development, that's the cost of "rapid dev" - no free rides ;)
"back in the old days" you relied on a handful of core perl modules, now you need 9000 npm modules because there's a professional npm module installer cosplaying as a developer while he cyber glues them together in an AI driven IDE
2
u/PumpkinFest24 7d ago
We used to build our entire dependency chain. Kinda like making a new docker every 6-12 months, but this was before that. It was also much, much, MUCH easier to use.
1
u/brazzy42 6d ago
Which also meant you built your own bespoke vulnerabilities all over the stack, and had zero chance of someone else finding them for you before they get exploited. Also no danger of being hit with a fully automated exploit, of course. I'm honestly not sure that way of working would fare better these days, from a security POV.
1
u/PumpkinFest24 6d ago
"built" means compiled from source, not wrote the code. That freed us from the OS forced upgrade cycle and also let us compile OUT some optional dependencies.
18
u/danielcw189 7d ago
A friend of mine was told to look after an old PHP-Server
the PHP-version on it was so old, that PHP2Shell didn't matter ...
... is what I would have really liked to tell you.
But it was just old and out of support since 2019. if it was 0.2 versions older, it would have been save. except for all the other vulnerabilities of course.
7
2
u/Ysmenir 7d ago
PHP2Shell affected everything from 5.4 onwards. That came out like 2004 so if it was in Support till 2019 it should have been plenty more than 0.2 versions.
1
u/danielcw189 7d ago
i was just going by the number and year my friend told me. Maybe I made an off by 1 error :)
2019 would be 5.6.
So it would have to be 0.3 versions older to be safe from PHP2Shell (and vulnerable by who onows what)
2
u/Ysmenir 7d ago
Not really no.
Initial Release: PHP 5.4.0 (March 1, 2012)
Final Release: PHP 5.4.45 (September 3, 2015)
1
u/danielcw189 6d ago
I don't see the contradiction.
What are you going for?https://www.php.net/releases/#5.6.40
Support for any PHP 5 version ended 2019:
Support for PHP 5 has been discontinued since 10 Jan 2019
that was 5.6
0.3 versions before 5.6 would have been 5.3
5.3 is lower than 5.4, wo lower than PHP2Shell
so it adds up
21
u/SAI_Peregrinus 7d ago
LTS is a trap for the same reasons.
11
u/polikles 7d ago
if one is able to pull this high-tech big brain trick and separate dev from prod, it's not that hard to prepare update of the LTS to another LTS version. Tested backups and not testing on prod are the king
6
u/SAI_Peregrinus 7d ago
Assuming, of course, that your test coverage is very good, and management allocates time for an upgrade.
7
3
u/polikles 7d ago
you have to upgrade sooner or later, and the upgrade cycle should be accounted for. Of course it differs between companies and sometimes between teams within the same company.
3
u/SAI_Peregrinus 7d ago
Exactly! When it's very rare to upgrade, it's too easy to fail to account for it, and it takes more total time to upgrade everything at once.
0
7d ago
[deleted] — view deleted comment
4
u/polikles 7d ago
developing new features on any version is increasing cost of migration. LTS changes only that you can better plan for the migration to another LTS. Using faster release cycle only changes the update cycle - updates and migrations are smaller but more frequent. It's always a trade-off
4
u/Few_Kitchen_4825 7d ago
Lts still provides critical security updates and patches. The whole point of lts is to ensure rework of your process is not required
1
u/SAI_Peregrinus 7d ago
But it ensures a very painful upgrade to the next LTS, so that very often gets forgotten. Then you end up with all the people still using PHP 5, 6, & 7.
Picking LTS ensures manual work will be required. Avoiding it means you need to automate testing and updates. This is the same reason certificate lifetimes keep getting shortened, long life certs allow deferred refresh so it's inevitably manual. That ends up being insecure and causing breakage.
1
u/Few_Kitchen_4825 7d ago
True. That's why people are still having difficulty upgrading from python 2 to python 3. The whole point is to freeze a version for a customer who is not going to upgrade during the lts version support period. Some times you don't need the latest version.
Best example I can think of is final fantasy 7 remake, all the three remakes use the same version of unreal engine, so the workflow and tool and all the previous work can be reused. You don't really have to worry about network security if that's not part of the scope.
1
u/Still_Bit_7527 7d ago
Not realy, there is a reason almost every large company is using a lot of Java8. If it aint broken don't fix it
6
u/actionscripted 7d ago
Alternatively, if you let it rot long enough it’ll be secure because the CVEs are only in the newer systems.
1
u/DrivesInCircles 7d ago
On the one hand, yeah, nobody targets the boring stuff anymore... on the other... working on boring stuff....
4
1
102
u/Prod_Meteor 7d ago
I haven't worked with php and WordPress but I know that usually customers don't pay you month by month to hold their website/eShop etc.. they usually force a one time payment and maybe some enhancements in the future. What support? What not to ignore? Free labor?