← Back to context

Comment by pseudosavant

3 hours ago

Is it just me, or is it the truly brave that decide to deploy and protect PHP instances? Especially if WordPress or Drupal are involve?

I finished moving the remainder of my stuff off of PHP and WordPress last year and haven't missed it at all. Backwards compatibility was typically pretty bad.

It seemed like maintaining existing working PHP code was always a cycle of: upgrade to newer PHP, that version has breaking changes, fix that code or update to a new WordPress (plus all of the plugins that would inevitably need updating too).

6 comments

pseudosavant

Reply
dofm  2 hours ago

I don't really want to be in the WordPress world anymore (I still maintain a couple alas).

But this isn't about PHP code, really — this is about C code (with less-than-ideal exception handler patterns). This problem is more Heartbleed than WP vulnerability.

I quite like modern PHP, I don't really think it's necessarily any less secure (exception handler weirdness notwithstanding), and more to the point, I don't think not using it is any kind of automatic improvement in web app security. It's not like server-side JavaScript is intrinsically better.

I am certainly doing some thinking today; I switched off a couple of web servers so I didn't have to think about them while I was working on other stuff, and actually I think they might not get switched back on. But it's not so much that they are running PHP as that they were kind of neglected and it's always worth reconsidering what you need to keep around.

I think I have reached a point where low value stuff is not worth subsidising just for fun.

(I have also reached the point where in future I won't be using distro packages for PHP)

  • pseudosavant  43 minutes ago

    Other runtimes certainly have their vulnerabilities. It is just that it seems like PHP values backwards compatibility less than Node, Python, Java, or C#. It seems like there is better tooling for running mixed versions of Node or Python than what I've experiences with PHP.

    And with the security fixes only landing on the relatively recent PHP versions, it means vulnerabilities force you into the PHP upgrade churn.

technion  2 hours ago

In nearly every org I've been in or contracted to, the public landing page of the company gets a special place outside of any ops of general technical team, and is instead the work of a marketing group or a "creative" outsourcer who will default to Wordpress on PHP.

  • casingno  12 minutes ago

    This is how it began and should stay, when IT teams started to get involved in this they ran heavy overhead and aren't clued in on creative requirements. Stick to keeping emails and erp servers up.

  • pseudosavant  33 minutes ago

    Seems like most main company sites at places I've worked. If you are lucky, that WP instance is a fully managed service where they proactively deal with keeping it on the latest PHP, WordPress, and plug-in versions.