Hacker News Reader

> If you compare it with production languages, PHP looks pretty weak.

8f your comparison excludes all the vulnerabilities they come with, sure.

In practice no one using Node is using it without npm. Same for every other language that has insane transitive dependencies for any non-trivial project.

PHP is no more vulnerable than those languages.

View on HN

>PHP is no more vulnerable than those languages.

In theory, perhaps not. In practice, much more vulnerable.

Okay but is it though? The PHP language and runtime itself has had practically no exploitable vulnerabilities for the past 10 years.

PHP applications might do suspicious things, by choice. But the runtime itself is fine. Certainly, there are less vulnerabilities in recent years in the PHP runtime than in, say, V8.

Reply on news.ycombinator.com