Login
You're viewing the y.diskcat.com public feed.
  • mhoyemhoye@cosocial.ca
    Oct 22, 2026, 2:45 PM

    My position is: PHP is excellent, and has been excellent for a very long time.

    Open, easy and accessible to not just learn and read but tinker with, it's not a ridiculous quasi-proprietary labor-arbitrage exercise disguised as a toolchain that you need a contraption of a CI/CD pipeline to deploy and it works.

    There might be better choices for professionals with green-field pro needs, but "one small, discoverable step up from HTML you can deploy right out of your VCS or editor"... that's a lot.

    💬 14🔄 62⭐ 199

Replies

  • Jason Lefkowitzjalefkowit@hachyderm.io
    Oct 22, 2026, 2:46 PM

    @mhoye The deployment story really is an important one. It amazes me that in all this time nobody has seriously tried to challenge PHP on it

    💬 3🔄 1⭐ 20
  • 💬 1🔄 0⭐ 6
  • FoolishOwlfoolishowl@social.coop
    Oct 23, 2026, 4:42 AM

    @mhoye @jalefkowit Okay, now I'm starting to get it.

    I've set up Dokuwiki and phpBB just by uploading tarballs and unpacking them into /var/www; everything else takes more infrastructure than that.

    💬 0🔄 0⭐ 2
  • 💬 0🔄 0⭐ 1
  • Artemisart_codesmith@toot.cafe
    Oct 22, 2026, 11:58 PM

    @jalefkowit @mhoye
    I mean.
    You can still do it with Python or Ruby. The only extra step is having to restart the server.
    People don't *generally* do it because you *usually* have extra steps like migrating your database and building the assets.

    💬 1🔄 1⭐ 2
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 1⭐ 1
  • Ken Butlernxskok@cupoftea.social
    Oct 22, 2026, 2:47 PM

    @mhoye not a web developer (at all), but I put together a website in php about 15 years ago and it worked for its purpose.

    💬 0🔄 0⭐ 3
  • pospipospi@kolektiva.social
    Oct 22, 2026, 2:54 PM

    @mhoye the previous website I built is #NodeJS, and what a garbage idea that turned out to be. Eats more than a gig of RAM just to stay afloat, requires recompiling & rebooting to update, crashes often, causes me many a pain.
    I could be doing the same on a 512MB server without breaking a sweat if I'd written this in #PHP. Sure the language is mostly just a thin wrapper to C system APIs and the global namespace is a dumpster fire saturated with identifiers, but this is also why it's so. fucking. resource. efficient. ❤️‍🔥

    They can dump on us, but the mud people will just keep writing PHP and outperforming 😂🤟🏻

    💬 1🔄 1⭐ 4
  • 💬 0🔄 0⭐ 0
  • David Beazleydabeaz@mastodon.social
    Oct 22, 2026, 2:54 PM

    @mhoye Years ago, the drummer in my band made his living slinging PHP as a free-lancer (no CS degree). Need I say more?

    💬 1🔄 1⭐ 8
  • the hatterhatter@metasocial.com
    Oct 22, 2026, 4:58 PM

    @dabeaz @mhoye No CS degree, lol. Those years ago, nobody building the internet, building the web, building sites, had a CS degree, or even if they did, it barely helped.

    💬 0🔄 0⭐ 4
  • 💬 0🔄 1⭐ 0
  • Space Hobospacehobo@teh.entar.net
    Oct 22, 2026, 2:57 PM

    @mhoye The other aspect of it was that your designers could load it into their visual tools and it wouldn't touch the `<?php` stuff. They just had some bizarre Lorem Ipsum text that had a lot of dollar signs.

    💬 0🔄 1⭐ 1
  • 💬 1🔄 0⭐ 1
  • mhoyemhoye@cosocial.ca
    Oct 22, 2026, 3:30 PM

    @pmonks "Today, there’s zero reason for an experienced polyglot programmer to pick PHP...."

    There are dozens of us! Dozens!

    (I couldn't read the whole thing, it's members only. But ... I mean, sure? To borrow an analogy, Wizards can ride magic horses or fly places on eagles, but most of the heroism of the world is getting where they need to go on foot.)

    💬 1🔄 1⭐ 8
  • pmonks (330ppm)pmonks@sfba.social
    Oct 22, 2026, 3:40 PM

    @mhoye I think the bigger question the post (which I was able to read in its entirety without an account, fwiw) raises, is that one cannot ignore hosting and operational factors (e.g. vulnerabilities, cost, etc.), and PHP is uniquely bad in that context.

    Applications that are “easy” to write, but practically impossible to host securely and cost effectively, aren’t “easy” at all.

    💬 0🔄 1⭐ 3
  • 💬 1🔄 0⭐ 2
  • j-r conlinjrconlin@mindof.jrconlin.com
    Oct 22, 2026, 4:36 PM

    @freddy @mhoye

    I used to work with Rasmus Lerdorf. He was quite open that PHP was built for doing simple things with page generation, since the whole "app" had to run in milliseconds while the page was being delivered. He conceded that the problem was that it was super compelling to add stuff into PHP, which just made things more complicated. A LOT of PHP apps really should be some other backend that PHP talks to.

    I'll admit, I stopped doing a lot of PHP a while ago. Now, I'll probably use javascript with XHTMLRequest calls and nginx rules, with a few python CGI scripts doing anything that needs heavy lifting, but I absolutely understand the strong appeal of PHP.

    💬 0🔄 0⭐ 0
  • 💬 1🔄 1⭐ 2
  • mhoyemhoye@cosocial.ca
    Oct 22, 2026, 10:26 PM

    @krapp the execution of PHP has been underneath most of the Web for most of the time we’ve had the Web.

    💬 1🔄 0⭐ 4
  • Kenneth Rappkrapp@krapp.masto.host
    Oct 22, 2026, 10:33 PM

    @mhoye And it's been an endless clownshow of vulnerabilities, SQL injections, shell injections, XSS and nonsense for most of the time we've had the web.

    The problem with PHP is that its simplicity is deceptive. You have to use a framework that understands context because you *will* forget to escape a variable, or not escape it properly. You have to use proper database management - PDO and prepared statements. You have to secure sessions and cookies. You have to *know* about

    💬 1🔄 1⭐ 3
  • Kenneth Rappkrapp@krapp.masto.host
    Oct 22, 2026, 10:36 PM

    @mhoye dozens of edge cases and step through countless hoops just to avoid the obvious vulnerabilities, and if you're using Wordpress, you have to deal with plugins and the decrepit nature of the framework itself.

    Using PHP properly is *hard*, and even when it's used properly sometimes there's just some bullshit baked into the language that will give anyone root anyway.

    It's not a good language.

    💬 0🔄 0⭐ 2
  • The Penguin of Eviletchedpixels@mastodon.social
    Oct 22, 2026, 5:37 PM

    @mhoye I agree with the main thrust of your argument but unlike BASIC and dBase and other historic tools that enabled users to just do stuff PHP exists in a space exposed to attack and basically hands the user a set of traps to fall into.

    If PHP was just for local unexposed page formatting it would be fine

    💬 0🔄 0⭐ 8
  • Paco Hopepaco@infosec.exchange
    Oct 22, 2026, 5:50 PM

    @mhoye You're not wrong. And I think it's parallel to LLM usage in the way it lets people do things that are inaccessible to them in any other way.

    I found Scott Hanselman's concept of "dark matter developers" related. And PHP fits this idea of a well-known, easy-to-use language that can get stuff done.

    The real issue is that PHP isn't "excellent." It's just easy and ubiquitous. In fact, someone who learns it first is in for an uphill climb to learn anything else because of all its eccentricities.

    It's easy to use and gets stuff done, but it's also full of footguns for the uninitiated. And it's most popular among the uninitiated.

    💬 0🔄 1⭐ 3
  • amy :neocat_cofe:amy@sk.girlthi.ng
    Oct 22, 2026, 7:26 PM

    @mhoye@cosocial.ca deployment is only easy if you know how to wrangle a CGI enabled reverse proxy into submission. if you have access to a host where this is preconfigured, then sure, but this isn't what i would think of as a standard availability nowadays

    💬 1🔄 0⭐ 0
  • mhoyemhoye@cosocial.ca
    Oct 22, 2026, 7:29 PM

    @amy I don’t know how to do any of that, and I run a custom fork of Wordpress using SQLite that I deploy with rsync.

    💬 3🔄 0⭐ 3
  • amy :neocat_cofe:amy@sk.girlthi.ng
    Oct 22, 2026, 7:37 PM

    @mhoye@cosocial.ca

    Note: The location of your root web directory in the filesystem on your web server will vary across hosting providers and operating systems. Check with your hosting provider or system administrator if you do not know where this is.
    https://developer.wordpress.org/advanced-administration/before-install/howto-install/#step-4-upload-the-files

    this was already handled by an admin, or you did it at some point prior. wordpress requires a CGI proxy to function, like most PHP apps. not to say CGI proxies are impossible to configure, just that it's a skill in systems administration like any other when it comes to deploying a website

    nginx, iis, apache would be the sorts of things you reach for here, along with php-fpm

    💬 0🔄 0⭐ 0
  • nflux back in exilenflux@gts.exile.social
    Oct 22, 2026, 8:47 PM

    @mhoye @amy ive run dozens of WP sites for over a decade on servers i build myself, have written dozens of plugins for wp and also have no idea what you just said...are you able to clarify?

    *i remember the term cgi (conmon gateway interface) being used in the context of perl scripting waaay back in the day (before asp and phpbexisted), but as far as im aware have not needed to configure one since then, unless it would have been presented under a different name

    💬 1🔄 0⭐ 0
  • 💬 2🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • amy :neocat_cofe:amy@sk.girlthi.ng
    Oct 22, 2026, 8:55 PM

    @nflux@gts.exile.social @mhoye@cosocial.ca i am now curious that apache is this easy to use for people who don't touch computers a lot. i always felt it was more complex than alternatives, but i wonder if this is because it does way more out of the box than others. this opinionated style is typically something that annoys me (because i have a very specific known usecase for myself)

    💬 0🔄 0⭐ 0
  • nflux back in exilenflux@gts.exile.social
    Oct 22, 2026, 8:50 PM

    @mhoye @amy or wait, do you just mean WP needs to run on a webserver like apache? (rather than some specific subset of apache which needs configuring a certain way)

    💬 0🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • nflux back in exilenflux@gts.exile.social
    Oct 22, 2026, 9:00 PM

    @amy @mhoye right ok. i came from IIS+asp so the idea of having a webserver+[scripting language addon] was just how it was done.

    typically apache has been pretty straightforward to deploy for that use case, and along the way i learned how to do other fancier stuff like setting up fwd/rev proxies (e.g to front something like owncast or other "back end" apps via ssl), even over fwd/rev ssh tunnels and the like, so i guess i thought you were suggesting id need some special config on top of basic apache+php installed., rather than outlining how it already worked

    💬 1🔄 0⭐ 0
  • 💬 3🔄 0⭐ 0
  • nflux back in exilenflux@gts.exile.social
    Oct 22, 2026, 9:04 PM

    @amy @mhoye ah ok, yeah setting up php on apache is like 3 terminal commands and maybe a bit of configuration re post sizes and any special options you might need.

    💬 0🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • nflux back in exilenflux@gts.exile.social
    Oct 22, 2026, 9:24 PM

    @amy @mhoye unfortunately once you have your wp up and running, and especially if your site is well ranked by the search engines... that's when your problems start i.e. the bot invasion starts.

    after my server got hacked from an out of date plugin in 2015 i got a bit obsessed with this subject and wrote a thing where all my sites work together to protect key endpoints and it seems to have been quite effective (still running, so far 0 hacks and eliminates 99.9% of spam signups).. which was especially relevant in a hostile environment like sexwork and it became something of a USP of my 'hosting'. it could even identify & silently redirect hostile traffic to a severely rate limited vhost (e.g 0.1kb/s) where returning a 100kb animated gif would take ages and quickly "slow loris" logjam attacks over proxychains.

    i have no idea how others deal with it tho bc jetpack, cloudflare & wafs like wordfence never really seemed to do much and that stuff was *draining*.

    💬 1🔄 0⭐ 0
  • amy :neocat_cofe:amy@sk.girlthi.ng
    Oct 22, 2026, 9:25 PM

    @nflux@gts.exile.social @mhoye@cosocial.ca what you're doing is a WAF, but one that actually addresses the attacks you're facing. you are developing an actually effective cloudflare for the attackers you're facing

    this is the life of a defender, though typically with something a little sturdier to base on than WP (notorious for its security, as i'm sure you're aware)

    💬 2🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • nflux back in exilenflux@gts.exile.social
    Oct 22, 2026, 9:31 PM

    @amy @mhoye
    i guess a waf that actually works then lol. i just soent a long time looking at the sword of requests I was getting and patterns between them and then wrote something that eventually got them all.

    but yeah wp themselves have some "unusual" views as to what is acceptable security-wise. i *think* they finally (in the last 12mo) changed it so that the json endpoints dont expose all the user details anymore but when i reported that along with a poc tool that scraped usernames and email addresses of users from a "standard" wp install, they replied "that's intended behaviour" 🤯🤦🏼‍♀️

    hypothetically if one were looking to break into a wp site, a good first step would be to have a list of usernames and whether those are admin or not and the json endpoints gave you exactly that, plus email addresses in case you needed a target to socially engineer/phish further access 👌#goodtimes

    💬 1🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • nflux back in exilenflux@gts.exile.social
    Oct 22, 2026, 9:38 PM

    @amy @mhoye

    check /wp-json/wp/v2/users/1

    vary the last number to scan thru the users.

    my "note to self" email about this is from 2018 and my test "canary" for this only stopped responding in the last 12mo (tho maybe they upgraded their security, idk and havent bothered to check any other sites).

    it's trivial to disable access but shocking that it isnt by default.

    💬 1🔄 0⭐ 0
  • 💬 4🔄 0⭐ 0
  • nflux back in exilenflux@gts.exile.social
    Oct 22, 2026, 10:17 PM

    @amy @mhoye there are often gaps so the userids are often not just 1,2,3,4 etc, may be more like 1,7,15,19 etc but with a script it's simple enough to scan eg the first thousand userids

    💬 0🔄 0⭐ 0
  • nflux back in exilenflux@gts.exile.social
    Oct 22, 2026, 10:21 PM

    @amy @mhoye you can do a similar trick on the author pages of the site to match userids to usernames (link to author usually on each blog post, if that isnt disabled).

    i kept noticing that attackers were trying real usernames but our display names were always deliberately different and I was confused as to where they were getting them from so again went on a bit of a dig about this and built a few poc tools to try and recreate their results (so that I could then block them to infinity)

    💬 0🔄 0⭐ 0
  • nflux back in exilenflux@gts.exile.social
    Oct 22, 2026, 10:23 PM

    @amy @mhoye *also the initial one is usually an admin, at which point they're one badly configured spf record (and/or missing dmarc) away from getting spoofed+phished, and both of those records are, again, public. you dont generally have to look very far to find a site with shoddy spf/dmarc either., though big mail providers recently *requiring* dmarc to be configured actually helped quite a lot there.

    💬 1🔄 0⭐ 0
  • nflux back in exilenflux@gts.exile.social
    Oct 22, 2026, 10:38 PM

    @amy @mhoye also the venn diagram of PBN sites on expired+revived domains and badly configured wp sites is basically a circle.

    *for everyone else: pbn sites are "personal blog network" sites which is an seo trick where you find an expired site like davestyreshop.com who were popular & well ranked but then dave retired/died/went bust & his domain expired but all the backlinks he accrued over his 20 years in business still exist. you use yandex & some other tools i forget the name of to find domains like that in the first place & also all the existing backlinks and then set up a new site with pages to match those old backlinks so they dont 404. you then scatter links thru that site to yourtyreshop.com (which you're actually trying to promote) & reap the benefit of Dave's 20 years of link building. repeat 3-5x for plenty of organic traffic (albeit relatively low quality, & imho it's better to just write good original content rather than resort to shitty tricks)

    💬 1🔄 0⭐ 0
  • 💬 0🔄 1⭐ 1
  • 💬 1🔄 0⭐ 0
  • 💬 0🔄 0⭐ 1
  • 💬 0🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • amy :neocat_cofe:amy@sk.girlthi.ng
    Oct 22, 2026, 11:37 PM

    @nflux@gts.exile.social @mhoye@cosocial.ca https://github.com/WordPress/WordPress/blob/master/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php#L504-L510 this is what stops you enumerating it normally, ie what i ran into on the demo instance

    and this is what's stopping me from enumerating all the juicy fields from a user. you need "edit" permission to do that

    https://github.com/WordPress/WordPress/blob/master/wp-includes/rest-api/endpoints/class-wp-rest-controller.php#L588-L596

    i will possibly have another look tomorrow because this code does seem overly complex and potentially prone to error. i already found a way to request specific users through the api (with the only pre-req being that they've ever written a post, with my current findings)

    💬 1🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • nflux back in exilenflux@gts.exile.social
    Oct 23, 2026, 12:12 AM

    @amy @mhoye well it's good that they've somewhat patched some of these things. the dismissive attitude i got when i reported it put me off pursuing it further, and to some extent my sites' survival depended on not being the easiest pickings, and their policy helped with that.

    i guess if they patched it (eventually) perhaps my report *was* actually valid then hmm, whaddya know 🤔

    am i allowed to be a bit smug about that, as a treat?

    💬 1🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0