Login
You're viewing the felin.social public feed.
  • Björkus "No time_t to Die" Dorkusthephd@pony.social
    Oct 22, 2026, 5:24 PM

    As I keep reading over the PHP patches I keep seeing the devastation not of people who don't know how to write secure software, but decades of people with very little resources tasked with writing the most widely used internet-facing software on earth in the programming language I am a participant in shaping. I see that the slow pace of adoption of things that we were told would help people 20, 30 years ago by security experts has not been adopted, and some of the world's most complex codebases using things as fragile as setjmp/longjmp and abort for error handling.

    I see, simply, that we are failing our software engineers by not having better in-language tools to mitigate and manage this level of complexity. That the pride in hacks we wore as a symbol of the power of C were in fact cries for help from a userbase that did not understand the long tail of consequences.

    Good luck and God Bless to the system administrators today and tomorrow and for the rest of this month. I'll do my best to make it so C isn't like this, anymore.

    💬 17🔄 103⭐ 197

Replies

  • 💬 1🔄 0⭐ 36
  • Joby (chaotic good)joby@hachyderm.io
    Oct 22, 2026, 5:29 PM

    @thephd Yeah, PHP is at this point such a broadly-deployed vital piece of infrastructure that it's embarrassing how little money it gets. The foundation *should* be funded enough to do tons of development with full-time dedicated developers for whom PHP internals is their day job.

    💬 0🔄 1⭐ 8
  • 💬 0🔄 0⭐ 2
  • Philip Braggsynx508@bsd.network
    Oct 22, 2026, 5:36 PM

    @thephd I've used PHP for many years but I'm not really a programmer and one of the big moments of "raw realness" for me was noticing features in PHP that didn't work the way I expected (constants, interfaces etc), submitting a bug and finding that it was in fact a bug in PHP. I was, at the time, trying to learn what these things were and PHP hadn't had them for long, so it was enlightening in many ways - not least that the people making the language didn't have much more of a clue than someone who'd had "shower thoughts" (actually a bath but w/ever) after reading a wikipedia page and the PHP manual.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 3
  • Dr. SobekSobex@sciences.re
    Oct 22, 2026, 6:26 PM

    @thephd Hmm, weren't you already on that committee for a few years already ? Or you were only on the outside pushing for change ? Or did I miss you getting out and now back in ?

    In any case, thanks and best luck !

    (Amusingly, I saw this post on the pinned fedi tab, on the window with two of your blog post are open in my todo read list since ages)

    💬 0🔄 0⭐ 0
  • Björkus "No time_t to Die" Dorkusthephd@pony.social
    Oct 22, 2026, 6:36 PM

    @Sobex Bigger and heavier C vulnerabilities have been popping off since I joined, I mean. I am starting to become a Committee "oldhead" now. In fact, in a few years I'll hit the "decade" mark!!!

    💬 1🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Martin Ueckeruecker@mastodon.social
    Oct 22, 2026, 6:30 PM

    @thephd I agree, but I would not limit this to in-language tools. The external tools we have are also insufficient. And the lack of resources for open-source maintenance is not helped by either, but a more fundamental problem. One good thing is that updating PHP is easy and fast, where supported by packaging systems (e.g. security-tracker.debian.org/tr). This is a massively underrated strength of the C ecosystem.

    💬 0🔄 0⭐ 2
  • Piti^^ the little LightpitiK3U@mastodon.online
    Oct 22, 2026, 6:40 PM

    @thephd
    What did the security experts say about error handling and etc. that are not adopted?

    I am not sure if I know what you are referring to exactly or what is the correct way.

    Let's say in regards to C?

    💬 1🔄 0⭐ 0
  • Rr@glauca.space
    Oct 22, 2026, 7:34 PM

    @pitiK3U @thephd OP has been trying to add "defer" to C, which is a mechanism for performing cleanup when leaving a scope (similar to "RAII" in languages like C++)

    this would've been very useful for the current PHP issues, because the current vulnerabilities involve incorrectly cleaning up memory when aborting a request

    💬 1🔄 0⭐ 2
  • Piti^^ the little LightpitiK3U@mastodon.online
    Oct 22, 2026, 7:53 PM

    @r @thephd
    Oh, thanks! I have read about the defer before (and I know about RAII), but wasn't sure if there is something else.

    I haven't read the php thing fully yet. It seems like I should give it a bit of a look.
    Thanks again!

    💬 1🔄 0⭐ 0
  • Björkus "No time_t to Die" Dorkusthephd@pony.social
    Oct 22, 2026, 8:26 PM

    @pitiK3U @r the first paper for a defer-like feature was around 2006/2007. It is 2026.

    Resource management has been a huge problem in C for decades, even before that. We have been warned repeatedly that certain language constructs and paradigms are lacking, and we told them the standard is fine, we just need more linters and checkers and analyzers.

    I think we are past the event horizon for these problems now, and have been for quite some time.

    💬 1🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • linear cannonlinear@nya.social
    Oct 22, 2026, 7:22 PM
    @thephd@pony.social your work is appreciated.

    adding things like defer and closures to C, and getting people to start considering them as idiomatic, would do a lot for the language and people using it, i think. and would make retroactively fixing some bad architectural decisions a lot easier.

    i'm glad you've been pushing for these sorts of things.
    💬 0🔄 0⭐ 0
  • David JONESdrj@typo.social
    Oct 22, 2026, 8:46 PM

    @thephd One of the bigger changes i would like to see in C is to push a bunch of "undefined behaviour" to "a bunch of bits are produced". float to unsigned produces undefined behaviour. No one except someone with a PhD in GCC optimisations wants that. What programmers would be okay with is "a bunch of bits are produced" and stuffed into your unsigned int. There are probably hundreds of these in the standard. And it is, i believe, what 1990s C programmers _expected_ the compiler to do. And it did, until the "advanced compiler optimisation" people came along and claimed undefined behaviour for their own. Obviously my suggested change affects no correct C program.

    💬 0🔄 0⭐ 0
  • Tim Ward ⭐🇪🇺🔶 #FBPETimWardCam@c.im
    Oct 22, 2026, 9:30 PM

    @thephd I never used setjmp/longimp. After studying the documentation I decided I just wasn't clever enough to understand how to use them safely.

    💬 0🔄 0⭐ 0
  • lucaluc0x61@mastodon.gamedev.place
    Oct 22, 2026, 9:34 PM

    @thephd What C may be blamed for, usually, is not taking by the hand its users like they're 4 (four!) years old.
    In that sense, successive languages helped their users - you tell me in what.
    Then, current LLMs are the perfect solution. Developers can finally average four, know almost nothing of a box with a round hole where they hammer a cube until it fits. The box with "wrong" holes is an LLM that adapts and takes anything in, just to collect the garbage. And you celebrate the box manufacturer.

    💬 1🔄 0⭐ 0
  • Björkus "No time_t to Die" Dorkusthephd@pony.social
    Oct 22, 2026, 10:32 PM

    @luc0x61 I, uh, don't think "people are just too stupid to use C properly" is a good starting point for an analysis of why one of the most used pieces of internet-facing software broke this way.

    Since you said "you tell me what", it turns out I have part of a foundational fix for this that's about to go to polling at the ISO level so it can be published as an independent Technical Specification, so that the issues PHP faced with abort, longjmp, and setjmp, are far less problematic to code for: pony.social/@thephd/1169085039

    But that's only the start of it, as some real Result types and other paradigms made much easier in C would probably also make healing these decades-old, mega-important codebases a lot easier. But I have a lot, LOT of things to fix while on the way to that second one, and honestly it's less adding Result(...) to C and moreso just making it even remotely pleasant for a normal user to write something like that. (We got part of the way in C23 with better compatibility rules.)

    💬 1🔄 0⭐ 0
  • lucaluc0x61@mastodon.gamedev.place
    Oct 23, 2026, 5:53 AM

    @thephd Well, I wouldn't use the word "stupid", but I think of a diminished attention to careful programming.
    I am quite critical to what has come to C23 and beyond. I find that "fixing C" will betray its initial simplicity, which was at the same time the source of many issues.
    With modern languages I have the feeling that complexity will require every day more efforts with the language than in knowing your application field, which is more crucial to me.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Nicky🦨✌️skoombidoombis@masto.ai
    Oct 22, 2026, 11:15 PM

    @thephd posts like this is why i lament the fact that programmers builders coders didn’t unionize and form guilds.

    💬 0🔄 1⭐ 0
  • mike805mike805@noc.social
    Oct 23, 2026, 12:22 AM

    @thephd C is basically assembly language with the details hidden. In assembly language, if you want to copy from a float to an int you have to decide which piece of the float.

    Given that PHP runs either in the Apache worker (mod_php) or in a separate worker process (fpm) calling exit(1) is the right way to handle out of memory. Your database transactions will roll back and the master will create a new process.

    If you are routinely going OOM your server is hosed anyway. (But not hacked.) 1/4

    💬 0🔄 0⭐ 0
  • ✧✦Catherine✦✧whitequark@treehouse.systems
    Oct 23, 2026, 2:49 AM

    @thephd (wouldn't abort() be a good thing here, security-wise? for an application that doesn't have persistent context across requests, aborting on an OOM condition seems pretty normal, and probably better than trying to handle the condition in first place...)

    💬 1🔄 0⭐ 0
  • >>>>>>>artemis@with.iridium.ink
    Oct 23, 2026, 5:00 AM

    @whitequark @thephd as someone who doesnt know php and was just reading other people mention this, i was wondering if it was a thing of like error handling written to crash and burn in a pre-fastcgi world, and then hacked up to try to crash and burn less to avoid fcgi process restarts (and thus, having to reload the bytecode). but like. i also figure id prefer the fcgi process to crash and burn and just get restarted, so idk.

    💬 1🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • twiconfusomu@twoot.site
    Oct 23, 2026, 5:03 AM

    @artemis @whitequark @thephd yes, from what i read, this seems to be the motivation behind this choice of error handling. the idea is that even if malloc fails, there is still some page returned to the client, instead of everything burning

    💬 1🔄 0⭐ 1
  • 💬 0🔄 0⭐ 0
  • >>>>>>>artemis@with.iridium.ink
    Oct 23, 2026, 5:05 AM

    @confusomu @whitequark @thephd i mean lua does also use setjmp/longjmp for error handling so maybe not the most cursed conceptually, but maybe theres a difference in implementation. ive read how lua does it and it seemed well-conceived to me

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • ✧✦Catherine✦✧whitequark@treehouse.systems
    Oct 23, 2026, 5:05 AM

    @confusomu @artemis @thephd I think there's a good way to solve this: just pass the fd to a new process. you could even call exec directly, it doesn't allocate

    (you might have to pre-allocate the arguments to exec but this is way simpler than what I hear they're doing)

    💬 1🔄 0⭐ 0
  • twiconfusomu@twoot.site
    Oct 23, 2026, 5:21 AM

    @whitequark @artemis @thephd this seems much simpler than trying to clean up from every call site, and you could still return something for the partially completed request.
    however, this wouldn't work for thread safe PHP (which apparently is a choice when using PHP with Apache, but FastCGI uses non-thread safe PHP) as it would drop other connections in the same process, unless you save their state (which seems extremely brittle)

    💬 0🔄 0⭐ 0
  • ✧✦Catherine✦✧whitequark@treehouse.systems
    Oct 23, 2026, 5:27 AM

    @confusomu @artemis @thephd I feel like "we're deprecating thread-safe PHP" might be a better way to address this issue than a never-ending stream of OOM fixes nobody has the bandwidth for, but I guess there are probably big hosts which want the former. Oh dear.

    💬 0🔄 0⭐ 0
  • Bearmine 🐾bearmine@gamepad.club
    Oct 23, 2026, 2:58 AM

    @thephd Please help turn C into something I actually want to use. That would be my ask as someone outside the community.

    💬 0🔄 0⭐ 0