Hacker News Reader

Comment by TacticalCoder | Hacker News Reader

I don't want to jinx it but... A discussion about, of all languages out there, PHP being the one hit by that and not, say, Go or Java or Rust or Haskell etc.?

Can we discuss that at least a tiny bit?

How do people feel about running servers with PHP today?

View on HN

I don't think most people that use PHP use it because they love it and find it a great technical solution, it's mostly technical debt being maintained and the fact that PHP is available to host everywhere.

I mean no language is immune to issues. Java world constantly sees fixes for both JVM and libraries. For example, besides famous log4shell, you can see still see in HTTP access log that bots are checking for vulnerable Struts versions. On the other hand, Java pushed to 100% Java (no native code) database drivers, while PHP strongly relies on c/c++ extensions, cause PHP is/was too slow. If there is any other difference, I think it just comes to legacy PHP approach - memory management didn't matter if entire request (and forked process that handles it) was alive for maximum few seconds.

These issues tend to happen way more in languages that depend on a runtime, especially one with dynamic lookup capabilities. If I remember correctly, log4shell depended on dynamic class loading and a lot of runtime-dependent stuff. Languages that are statically-compiled and memory-safe (namely Go and Rust) don't have the runtime vector and don't generally have the memory safety vectors either. I feel a lot safer deploying services written in Go than JS, for example.

Anxious and slowly rewriting said services in other languages as time allows lol

Reply on news.ycombinator.com