Hacker News Reader

Comment by remi_forax | Hacker News Reader

Here is why I've chosen the name the language PHP.reboot. My father ask me to patch one of the page of his website written in PHP so I've written one page of PHP. 3 days later, my younger brother (not 18 years old at that time) call me and ask me to never touch a PHP page again because I had introduced 3 security holes. It was a painful day for me, I have a Phd in Computer Science, I study computer languages, compilers and runtimes but I'm not able to write a correct PHP script.

That's why I think I own the right to call this language PHP.reboot.

Rémi

View on HN

Don't get me wrong, I think the project is a neat one. I like the features, I like the goal, and honestly I just like new-language projects in general. So please don't think I'm hating on the project.

But your argument for the name is so utterly broken.

First of all, having a PhD in CS and introducing 3 security holes is no reason to blame the language. It's not even necessarily a reason to blame yourself. Since when is a PhD in CS supposed to make you a good software engineer? If it is, I know a lot of PhDs who got a raw deal.

Second, how does your language fix the three security bugs you introduced? The only security feature I see in your highlights list is "secure by default: no eval, no magic quotes/string interpolation". 99 out of 100 competent PHP programmers force magic quotes off (so if your brother didn't, he can shut up), and most bugs that can be introduced with string interpolation can be (and usually are) introduced with string concatenation (which I assume you can still do).

Third, the main thing you demonstrated with this story (as others have said) is that you aren't very good with PHP. That's no big shame, but it's also not a reason you "own the right to call this language PHP.reboot". This reasoning is crazyface.

Fourth, as others have said, calling it "PHP.reboot" just confines it to the ghetto. If it were to grow, people wouldn't be able to search for articles/blogs/forums/help/mail/etc about it without getting lost in the PHP (even admitting that for me googling "php reboot" does return your google-code repo). And right in the name it says "I'm the wanna-be little brother of the big successful language". Although I don't think this last criticism is a problem, because I assume the goal was not to actually replace PHP, because that's impossible for reasons others have mentioned. So, no big deal.

The GOOD argument for the name is "It's just a toy language, so it doesn't matter what it's called, and rebooting PHP was my motivator when I started this particular project."

Oh, and as an aside, if one page of PHP is your web programming experience, then you really should probably not be shipping an HTTP server.

I agree with you, I'm not a good PHP developer. Before that bad experience, I was thinking that PHP was a kind of visual basic for the Web. Easy to write, fast to get something. I was wrong, that why I've called my language PHP.reboot because I think that PHP in 2010 should be rebooted to be secure by default.

Now, the main point of this toy language as you call it is to demonstrate that a dynamic language can be fast if you don't design it with an interpreter in mind. BTW, I really hope that this is what Dart is.

Rémi

> Oh, and as an aside, if one page of PHP is your web programming experience, then you really should probably not be shipping an HTTP server.

I disagree. How are webprogramming skills applicable to writing a HTTP server? Seems to me the relevant skill would be network programming and my (admittedly limited) web developing experience leads me to believe the skills are mostly if not completely disjoint...

Yeah, that's absolutely true, so I overstated my case somewhat on that point (although in my defence I did say "probably"). So, in place of the mis-stated claim in my original comment, let me try that part again.

Writing robust high-load network servers is actually a little tougher than it seems, and the skillset has very little overlap with the "designing a nice language" skillset, or the "making an efficient compiler" skillset. And not only is robustness is important, but to be useful it probably needs a lot of auxiliary features like HTTPS and authentication and logging and FSM-knows-what-all (this point, on which features matter, is the only place that web-programming experience might actually be relevant). And so tacking a half-assed HTTP server onto your new-language project is, well, half-assed. And IMO, there are enough shitty toy web-servers out there already.

As much as I hate just citing a logical fallacy, that's a nonsequitor. You "own" the name because... you can't program in it after what must have been entire hours of effort? If we're going to go down that route at all, that's an argument that you don't have any right to the name, since you've put next to zero effort into it.

Of course, the real reason is that no, you don't own the right to the name, in any sense, but hey hoo, carry on, whatever.

What's with the attitude? Remi just explained the background for the name of his neato prototype PHP-like project. I don't see why that deserves these kinds of snarky replies.

Because hijacking the name of a popular project is a dickish move in general (see http://www.php.net/license/index.php#faq-lic), doing it for ludicrous reasons even more so.

That's the worse reason I've ever heard of to create a new language. If I was asked write ruby or .net or java it probably wouldnt be great code either. That doesn't mean they're language issues, that means I don't know those languages, plain and simple.

Php reboot has less to do with php being broken and more to do with your ego refusing to accept that you're not the worlds nest programmer.

And thank god for that, birds would be falling out of trees all over the place!

No, unlike PHP, PHP.reboot is secure by default. That's why PHP.reboot use DSLs, because it enables the runtime to know the context thus sanitize the inputs by itself.

Rémi

Apologies for the typos - I posted from a phone.

As for "Secure by default". PHP can be perfectly secure. PDO supports parameterised queries, and was first available in PHP 5.1, which shipped just short of SIX YEARS AGO. Even mysqli supports parameterised queries, and that shipped more than SEVEN YEARS AGO.

If you're using the ancient mysql extension (i.e. the mysql* functions) that is YOUR FAULT, not the fault of the language.

  I'm not able to write a correct PHP script.
  That's why I think I own the right to call this language PHP.reboot.

If you think you can hijack the name of a programming language name like this you will probably have to come up with a better reason than this.

  I have a Phd in Computer Science, I study computer 
  languages, compilers and runtimes

No, that's not a good enough reason.

Reply on news.ycombinator.com