Hacker News Reader

Comment by spacedcowboy | Hacker News Reader

Well, it was episode I, which of course was the 4th film.

It's not which verion of Star Wars you worked on in what year, it's that you're choosing to defend mysql_real_escape_string, and the culture that produced and maintained and evangelized it.

What you've so brilliantly and unwittingly illustrated here is that PEOPLE MAKE MISTAKES. And that contradicts your argument that attempts to shift the blame for PHP's footguns like mysql_real_escape_string onto "crappy coders" instead of the culture and designers of PHP itself. People love to use that argument the self-aggrandize themselves, claiming they're too smart to make those mistakes, and only crappy inexperienced coders do that, so it's not a problem.

But PHP has always been widely evangelized to inexperienced coders, foot-guns and all.

Yes it DOES make a difference if a language is full of foot-guns, and the culture and developers around it don't give a shit (and don't bother running tests before checking in buggy changes to crypto functions before making a release) because they think they're too hot-shot to aim the foot-guns they designed and loaded at their own feet, then go around evangelizing their language to inexperienced crappy programmers.

https://www.php.net/archive/2011.php#id2011-08-22-1

5.3.7 upgrade warning

[22-Aug-2011]

Due to unfortunate issues with 5.3.7 (see bug#55439) users should postpone upgrading until 5.3.8 is released (expected in a few days).

https://bugs.php.net/bug.php?id=55439

Bug #55439 crypt() returns only the salt for MD5

https://news.ycombinator.com/item?id=2912678

Do not upgrade to PHP 5.3.7 due to a bug in crypt() (php.net)

https://news.ycombinator.com/item?id=2913310

dramaticus3 on Aug 22, 2011 | parent | favorite | on: Do not upgrade to PHP 5.3.7 due to a bug in crypt(...

Get ready for some WTF-ery Crypt takes an optional salt. If that value is an MD5 hash it is prefixed with the chars $1$ to tell the underlying crypt(3) function to use Modular Crypt Format[1]. MCF is an ad-hoc cruft because the orginal crypt() is weak.

Anyway guess who did it :

"let's use strlcpy/strlcat instead for these static string copies" - Rasmus I guess that's Lerdorf himself

Whoever it was also didn't check the return values for error. Strlcat returns the length of the new string which might not be the same as strlen(dst) + strlen(src).

"I'm not a real programmer. I throw together things until it works then I move on." - Rasmus Lerdorf

Here's where he broke it : Sun Aug 7 16:10:34 2011 UTC http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/php...

Here's it being fixed : Fri Aug 19 22:49:18 2011 UTC http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/php...

[1] http://packages.python.org/passlib/modular_crypt_format.html

rll on Aug 22, 2011 [–]

If you have never broken anything you have probably never built anything.

dramaticus3 on Aug 22, 2011 [–]

The project leader. Tests, I'm in charge, I don't test.

dangrossman on Aug 22, 2011 [–]

This code had a unit test, and it failed after the change as expected:

http://gcov.php.net/viewer.php?version=PHP_5_3&func=tests&fi...

Um, I'm not defending mysql_real_escape_string. I'm not sure how you got that from what I wrote. I was saying use PDO.

Anyway, I don't care enough about what you're going on about to spend the effort arguing with you - it seems like you just want to argue, so how about we say "you win" and move on.

I know you don't care, you've made that very clear. If you cared about truth or accuracy, you wouldn't have made an appeal to your own authority by bragging about impossibly using PHP and making database driven web sites for 39 years, or tried to excuse your moving the goalposts by claiming to "have a bad habit of not clicking on parent to see what the context of a post is".

"I don't care" is Rasmus Lerdorf's attitude about security, software quality, programming, computer science, and unit tests, which is my point. mysql_real_escape_string is just a symptom that you're brushing aside and ignoring of the real problem you're in denial of, but guilty of yourself, which is systemic CARELESSNESS.

"We have things like protected properties. We have abstract methods. We have all this stuff that your computer science teacher told you you should be using. I DON'T CARE about this crap at all." -Rasmus Lerdorf

"I'm not a real programmer. I throw together things until it works then I move on. The real programmers will say Yeah it works but you're leaking memory everywhere. Perhaps we should fix that. I'll just restart Apache every 10 requests." -Rasmus Lerdorf

"PHP is about as exciting as your toothbrush. You use it every day, it does the job, it is a simple tool, so what? Who would want to read about toothbrushes?" -Rasmus Lerdorf

"I actually hate programming, but I love solving problems." -Rasmus Lerdorf

"I don't know how to stop it, there was never any intent to write a programming language [...] I have absolutely no idea how to write a programming language, I just kept adding the next logical step on the way." -Rasmus Lerdorf

"When the world becomes standard, I will start caring about standards." -Rasmus Lerdorf

"I don't like programming. It's tedious." -Rasmus Lerdorf

What are you getting out of this? He worked on php and look how far it came, what have you done?

Your own website was written in php which you took down due to a security vulnerability in a framework... now is it php fault that someone wrote vulnerable code?

"Temporarily offline due to Drupal security vulnerability."

When did I blame php for Drupalgeddon? My web site says "Drupal security vulnerability", not "PHP security vulnerability", so I don't know where you're getting that from.

Back to the point: We're discussing mysql_real_escape_string. What's your excuse for it even existing in the first place, instead of simply fixing the security hole in the original mysql not-so-real escape string function?

Melania Trump's "I REALLY DON'T CARE DO U?" jacket sums up Rasmus Lerdorf's attitude towards security, software quality, programming, stardards, computer science, and unit tests. I just quoted his own words and bug reports that prove that point.

Do you like to leave loaded AK47s strewn around daycare centers, then blame the kids when they shoot each other? Is it ok if after the massacre you realized you made a mistake, and then scatter a few Nerf Guns around so the smart experienced kids who survived will have something safe to play with, but you still leave all the loaded AK47s?

I asked what you did. Then asked if drupals security was phps fault.

Are you seriously this butthurt about a function name, look up where the name came from originally. I also wonder what magical perfect language you use, dont tell me its php...

Not sure where you're going with the rest of this comment so I wont entertain that part. whew...

Survivor bias. For Rasmus there were 10000 other developers which have been relegated to just annoying their fellow enterprise coders.

It looks a lot more like someone there at the right place and the right time.

This is quite the thread and I'm having trouble following it, so maybe there's a reason why you're referencing such an old version, but you know PHP's currently on 7.4 right? Tons of progress over the last few years. If someone picks up a book that's 10 year's old or reads a blog post from 2010 and expects it to be 'current' then they have bigger issues. There are plenty of resources that cover modern PHP.

Reply on news.ycombinator.com