- codydodd@lemmy.caEnglish5 days
I hate to sound so elitist but the minute I could stop using php I moved on and never looked back. Sure, a separate backend language is more work but its so much more secure and scalable.
4 daysWhat did you move on to that doesn’t ever have vulnerabilities? We’d love to move on too!
- codydodd@lemmy.caEnglish4 days
Everything has vulnerabilities but a separate rest API lets you lock down far more access points especially if you further lock down the database itself. I like to fire up dockerized Django API frameworks when I need a secure, scalable rest in a hurry.
- spankysalmon@fedinsfw.appEnglish5 days
You made the correct move. PHP is trash the world needs to recognise as trash.
- HerbGrower@slrpnk.netEnglish5 days
Why? I have used it for a few projects, it seems to be fine usually. Great performance for the end user and simple to setup.
- spankysalmon@fedinsfw.appEnglish5 days
Because “functional”, and, “an actually good idea as to how to implement something” are two wholly different realms.
Something everyone defending “AI” will learn the hard way.
- HerbGrower@slrpnk.netEnglish4 days
Isn’t the solution here to just run apt update and apt upgrade once packages are ready which they probably will be quite quickly
- spankysalmon@fedinsfw.appEnglish3 days
That merely describes how to acquire any “fixes”, and does not describe in any way the efficacy of such fixes.
Not to mention the collateral that can happen in the mean time.
PHP has never been the respite of the security conscious, let alone a paragon of good ideas. Those who cling on to such terrible ideas will merely face an ever tilting uphill battle.
- jaybone@lemmy.zipEnglish5 days
Obviously everyone has been moving to rest APIs with js front ends, almost regardless of language and framework. The whole html template approach with server side code rendering has been dead for over a decade. But I’m seeing people still heavily defend PHP here on lemmy in the wake of this recent security incident.
- spankysalmon@fedinsfw.appEnglish5 days
No it hasn’t. Many modern frameworks have server side rendering as a prominent feature.
Also, it’s exceptionally stupid to do everything server-side.
There are valid reasons for it, very privacy conscious people often hate sites that require or use javascript because it enables advanced fingerprinting and other threats and is basically impossible to vet
- rumba@lemmy.zipEnglish5 days
I get it, it’s rapid. We all used it when we fled from perl/cgi. It had all the features and modules.
I will say this, in an unpopular defense of AI, Like it or not, the inhuman security audits cometh and they are going to make sure ALL our shit is properly exposed and fixed.
