Oct 22, 2026, 2:30 PM(Me, whispering: Maybe the reason PHP is everywhere and in everything is that ease of use, ease of modification and ease of deployment are actually good things and making easy, fun things safe is way, way more important to real world practices and uptake than trying to graft ease of use and fun onto guarantees of safety that computing has never been willing, much less able, to really guarantee anyway.)
Oct 22, 2026, 2:45 PMMy position is: PHP is excellent, and has been excellent for a very long time.
Open, easy and accessible to not just learn and read but tinker with, it's not a ridiculous quasi-proprietary labor-arbitrage exercise disguised as a toolchain that you need a contraption of a CI/CD pipeline to deploy and it works.
There might be better choices for professionals with green-field pro needs, but "one small, discoverable step up from HTML you can deploy right out of your VCS or editor"... that's a lot.
@mhoye It's like some folks don't want a whole CI/CD just to update their website...
Oct 22, 2026, 3:11 PM@JessTheUnstill God, yeah. "Oh, everyone knows that if you're going to learn ReactFlorboz on your own, first you need to learn to be a systems admin to install the ninjyblizner sconzadonk pipeline so the fragglet fonkastonk automatically rebuild and you can automatically recompile your scrumpwingle widgelets when you redeploy your cloud oompa-loompdas."
"Why would I do any of that?"
"Obviously because otherwise it won't scale."
Mm. 'Why do I have to use Mongo?'
'Because it's webscale. Do you even lift, bro? Etc.'
Oct 24, 2026, 2:54 PM@mhoye @JessTheUnstill i just copy and paste my little web page from the folder where it lives on my computer to the folder where it lives on my server when i want to update it 😌
Oct 22, 2026, 2:44 PM@mhoye @petrillic “We choose to do these things, memory safety, and to execute an longjmp and return safely to the calling function, by the end of this decade, not because they are easy, but because they are hard!” -— JFK.
@mhoye The deployment story really is an important one. It amazes me that in all this time nobody has seriously tried to challenge PHP on it
Oct 22, 2026, 10:24 PM@jalefkowit sftp, or rsync, or literally just “cp”. It’s almost nothing.
@mhoye @jalefkowit Okay, now I'm starting to get it.
I've set up Dokuwiki and phpBB just by uploading tarballs and unpacking them into /var/www; everything else takes more infrastructure than that.
@foolishowl @mhoye @jalefkowit Yesterday I had to migrate a phpBB site with 250,000 posts to a new host; it really just involved copying the files and the database, and it worked straight away.
@pheraph @foolishowl @mhoye @jalefkowit The way that I miss being able to deploy things this way. It was so much easier to wrap my head around. I feel like the simplicity made everything else easier from deployment, to patching, to backups/restores, to firewalling and applying restrictions.
I miss being able to just pop open a text editor and start hacking on stuff too. It is like a sewing machine vs handsewn. When I want to sew, I want to sew, not spend hours setting up my sewing environment.
@jalefkowit That PHP is pretty friendly to hosters, for example with the option to set integrated usage limits, is another plus.
Matching that is really hard.
That said: PHP makes it really easy to shoot yourself in the foot, and many already did.
@mhoye
Oct 22, 2026, 11:58 PM@jalefkowit @mhoye
I mean.
You can still do it with Python or Ruby. The only extra step is having to restart the server.
People don't *generally* do it because you *usually* have extra steps like migrating your database and building the assets.
@art_codesmith @jalefkowit @mhoye Yeah also was about to say that, any interpreted language should offer the same advantage, should not it?
Oct 23, 2026, 8:30 AM@rugk @jalefkowit @mhoye Even a compiled language.
You build the binary, upload the binary, restart the process.
@art_codesmith @jalefkowit @mhoye I'm not sure python is a great example, you need to learn two languages, python and jinja, as well as uv or pip and the ecosystem is all about breaking compat somewhere in the dep tree requiring virtualenv, CI with automated testing and regular maintenance just to stay working.
Python does not really deploy just by copying some files over sftp and its not something you can just add to HTML for light server-side scripting. I think tools like Django are great for building common CRUD apps when some business process outgrows a spreadsheet, but PHP has a whole other set of use cases its optimized for.
@jalefkowit
PHP grew up with Apache, just like Javascript grew up with browsers. It's always going to be easier to use them than to replace them.
@mhoye
@jalefkowit @mhoye Netlify, Vercel, Render, etc. try to make it as simple for JavaScript apps. It's a little bit more complicated, but still not very complicated to deploy them. But yes, would be interesting to just needing to upload them and being done. Cloud functions in general are going into that direction. There are a lot of implications for them already.
@mhoye not a web developer (at all), but I put together a website in php about 15 years ago and it worked for its purpose.
@mhoye the previous website I built is #NodeJS, and what a garbage idea that turned out to be. Eats more than a gig of RAM just to stay afloat, requires recompiling & rebooting to update, crashes often, causes me many a pain.
I could be doing the same on a 512MB server without breaking a sweat if I'd written this in #PHP. Sure the language is mostly just a thin wrapper to C system APIs and the global namespace is a dumpster fire saturated with identifiers, but this is also why it's so. fucking. resource. efficient. ❤️🔥
They can dump on us, but the mud people will just keep writing PHP and outperforming 😂🤟🏻
Oct 23, 2026, 9:51 PM
@mhoye Years ago, the drummer in my band made his living slinging PHP as a free-lancer (no CS degree). Need I say more?
@mhoye The other aspect of it was that your designers could load it into their visual tools and it wouldn't touch the `<?php` stuff. They just had some bizarre Lorem Ipsum text that had a lot of dollar signs.
Oct 22, 2026, 3:30 PM@pmonks "Today, there’s zero reason for an experienced polyglot programmer to pick PHP...."
There are dozens of us! Dozens!
(I couldn't read the whole thing, it's members only. But ... I mean, sure? To borrow an analogy, Wizards can ride magic horses or fly places on eagles, but most of the heroism of the world is getting where they need to go on foot.)
@mhoye I think the bigger question the post (which I was able to read in its entirety without an account, fwiw) raises, is that one cannot ignore hosting and operational factors (e.g. vulnerabilities, cost, etc.), and PHP is uniquely bad in that context.
Applications that are “easy” to write, but practically impossible to host securely and cost effectively, aren’t “easy” at all.
Oct 22, 2026, 4:24 PM@mhoye yup. Still reaching for php if all I need is a bit of html and a some http headers
Oct 22, 2026, 4:36 PMI used to work with Rasmus Lerdorf. He was quite open that PHP was built for doing simple things with page generation, since the whole "app" had to run in milliseconds while the page was being delivered. He conceded that the problem was that it was super compelling to add stuff into PHP, which just made things more complicated. A LOT of PHP apps really should be some other backend that PHP talks to.
I'll admit, I stopped doing a lot of PHP a while ago. Now, I'll probably use javascript with XHTMLRequest calls and nginx rules, with a few python CGI scripts doing anything that needs heavy lifting, but I absolutely understand the strong appeal of PHP.
Oct 22, 2026, 5:13 PM@mhoye The *concept* of PHP is good, but the *execution* is terrible.
Oct 22, 2026, 10:26 PM@krapp the execution of PHP has been underneath most of the Web for most of the time we’ve had the Web.
Oct 22, 2026, 10:33 PM@mhoye And it's been an endless clownshow of vulnerabilities, SQL injections, shell injections, XSS and nonsense for most of the time we've had the web.
The problem with PHP is that its simplicity is deceptive. You have to use a framework that understands context because you *will* forget to escape a variable, or not escape it properly. You have to use proper database management - PDO and prepared statements. You have to secure sessions and cookies. You have to *know* about
Oct 22, 2026, 10:36 PM@mhoye dozens of edge cases and step through countless hoops just to avoid the obvious vulnerabilities, and if you're using Wordpress, you have to deal with plugins and the decrepit nature of the framework itself.
Using PHP properly is *hard*, and even when it's used properly sometimes there's just some bullshit baked into the language that will give anyone root anyway.
It's not a good language.
@mhoye I agree with the main thrust of your argument but unlike BASIC and dBase and other historic tools that enabled users to just do stuff PHP exists in a space exposed to attack and basically hands the user a set of traps to fall into.
If PHP was just for local unexposed page formatting it would be fine
Oct 22, 2026, 5:50 PM@mhoye You're not wrong. And I think it's parallel to LLM usage in the way it lets people do things that are inaccessible to them in any other way.
I found Scott Hanselman's concept of "dark matter developers" related. And PHP fits this idea of a well-known, easy-to-use language that can get stuff done.
The real issue is that PHP isn't "excellent." It's just easy and ubiquitous. In fact, someone who learns it first is in for an uphill climb to learn anything else because of all its eccentricities.
It's easy to use and gets stuff done, but it's also full of footguns for the uninitiated. And it's most popular among the uninitiated.
Oct 22, 2026, 7:26 PM@mhoye@cosocial.ca deployment is only easy if you know how to wrangle a CGI enabled reverse proxy into submission. if you have access to a host where this is preconfigured, then sure, but this isn't what i would think of as a standard availability nowadays
Oct 22, 2026, 7:29 PM@amy I don’t know how to do any of that, and I run a custom fork of Wordpress using SQLite that I deploy with rsync.
Oct 22, 2026, 7:37 PMNote: The location of your root web directory in the filesystem on your web server will vary across hosting providers and operating systems. Check with your hosting provider or system administrator if you do not know where this is.https://developer.wordpress.org/advanced-administration/before-install/howto-install/#step-4-upload-the-files
Oct 22, 2026, 8:47 PM@mhoye @amy ive run dozens of WP sites for over a decade on servers i build myself, have written dozens of plugins for wp and also have no idea what you just said...are you able to clarify?
*i remember the term cgi (conmon gateway interface) being used in the context of perl scripting waaay back in the day (before asp and phpbexisted), but as far as im aware have not needed to configure one since then, unless it would have been presented under a different name
Oct 22, 2026, 8:48 PM@nflux@gts.exile.social @mhoye@cosocial.ca you'd have to deploy apache or similar in some fashion to actually run the php, as best i can tell the wordpress installer does not explain how to do this. id be curious what is used if not apache though.
Oct 22, 2026, 8:51 PMOct 22, 2026, 8:55 PM@nflux@gts.exile.social @mhoye@cosocial.ca i am now curious that apache is this easy to use for people who don't touch computers a lot. i always felt it was more complex than alternatives, but i wonder if this is because it does way more out of the box than others. this opinionated style is typically something that annoys me (because i have a very specific known usecase for myself)
Oct 22, 2026, 8:50 PMOct 22, 2026, 8:52 PM@nflux@gts.exile.social @mhoye@cosocial.ca perhaps apache comes out of the box with this, sure, my point was more generally that deploying any dynamic thing is more complicated than static pages
you could equally use python, shell, etc which are all supported by CGI (the thing that runs your PHP)
Oct 22, 2026, 9:00 PM@amy @mhoye right ok. i came from IIS+asp so the idea of having a webserver+[scripting language addon] was just how it was done.
typically apache has been pretty straightforward to deploy for that use case, and along the way i learned how to do other fancier stuff like setting up fwd/rev proxies (e.g to front something like owncast or other "back end" apps via ssl), even over fwd/rev ssh tunnels and the like, so i guess i thought you were suggesting id need some special config on top of basic apache+php installed., rather than outlining how it already worked
Oct 22, 2026, 9:01 PM@nflux@gts.exile.social @mhoye@cosocial.ca in other reverse proxies (nginx, eg) you would need to apply some config to make these scripting langs work. thanks for the insight
and apologies to op, i was overly brash and hostile to your view
Oct 22, 2026, 9:04 PMOct 22, 2026, 9:06 PMOct 22, 2026, 9:06 PM@nflux@gts.exile.social @mhoye@cosocial.ca sqlite gets a thumbs up from me. we love sqlite
Oct 22, 2026, 9:24 PM@amy @mhoye unfortunately once you have your wp up and running, and especially if your site is well ranked by the search engines... that's when your problems start i.e. the bot invasion starts.
after my server got hacked from an out of date plugin in 2015 i got a bit obsessed with this subject and wrote a thing where all my sites work together to protect key endpoints and it seems to have been quite effective (still running, so far 0 hacks and eliminates 99.9% of spam signups).. which was especially relevant in a hostile environment like sexwork and it became something of a USP of my 'hosting'. it could even identify & silently redirect hostile traffic to a severely rate limited vhost (e.g 0.1kb/s) where returning a 100kb animated gif would take ages and quickly "slow loris" logjam attacks over proxychains.
i have no idea how others deal with it tho bc jetpack, cloudflare & wafs like wordfence never really seemed to do much and that stuff was *draining*.
Oct 22, 2026, 9:25 PM@nflux@gts.exile.social @mhoye@cosocial.ca what you're doing is a WAF, but one that actually addresses the attacks you're facing. you are developing an actually effective cloudflare for the attackers you're facing
this is the life of a defender, though typically with something a little sturdier to base on than WP (notorious for its security, as i'm sure you're aware)
Oct 22, 2026, 9:26 PM@nflux@gts.exile.social @mhoye@cosocial.ca CF is a protection racket for DDoS imo.
Oct 22, 2026, 9:32 PMOct 22, 2026, 9:31 PM@amy @mhoye
i guess a waf that actually works then lol. i just soent a long time looking at the sort of requests I was getting in the www logs and patterns between them and then wrote something that eventually got them all.
but yeah wp themselves have some "unusual" views as to what is acceptable security-wise. i *think* they finally (in the last 12mo) changed it so that the json endpoints dont expose all the user details anymore but when i reported that along with a poc tool that scraped usernames and email addresses of users from a "standard" wp install, they replied "that's intended behaviour" 🤯🤦🏼♀️
hypothetically if one were looking to break into a wp site, a good first step would be to have a list of usernames and whether those are admin or not and the json endpoints gave you exactly that, plus email addresses in case you needed a target to socially engineer/phish further access 👌#goodtimes
Oct 22, 2026, 9:34 PM@nflux@gts.exile.social @mhoye@cosocial.ca i'm equal parts shocked and unsurprised that it's trivial to scrape that from WP, and that they dismissed it
wish we could have something better