Comment by hinkley

The only time I ever allowed myself to have the PHP is a security nightmare conversation at work, I came in the very next morning to find the lone PHP supporter was having to patch the drupal instance he supported because it had been hacked and defaced. I tried not to be smug about it because the timing made it look like maybe I was the culprit, and I was still new there.

But he never mentioned PHP again which was just fine with me.

In trust situations we have a sort of unspoken concept of Original Sin. Essentially once someone has made a security blunder of epic proportions, we can not trust that this is an isolated incident instead of a pervasive one. If The Rot Starts at the Head is true, then how can any amount of rework ever make you trust the thing again?

I looked at the security patch that Drupal applied, and I’m no PHP reader but I was sure I found the same antipattern in two other places in the code that were not patched. I only looked for an hour. There have been years and years of low effort CERT advisories since. From a user standpoint, if you’re not deep into Sunk Cost, this looks like throwing good money after bad. Only rationalization ever makes it seem like a good deal.