Hacker News new | past | comments | ask | show | jobs | submit login

> Suggestion to make those parts read-only was rejected as a 0.6% performance impact was deemed too expensive for too little gain.

Big Oof. :( :( :(




I'm okay with the tradeoff. PHP prioritizing speed over uncommon security is the right call here.


missing /j


At a large PHP shop, 0.6% can be tens of millions of dollars.


Over what time period? You’re implying they are spending at least a billion dollars on hardware costs for 0.6% to be tens of millions.


At a large PHP shop, a successful exploit can be the end of the company.


almost everyone have all the things required for those exploits disabled.

why would i accept performance penalty if i don't allow open('https://google.com') to begin with?

the correct action would be to remove all the stupid features everyone serious disable to begin with.


It seems hard to "disable" the issues mentioned at https://dustri.org/b/upcoming-hardening-in-php.html


PHP is a bad choice to begin with if your use case is that performance critical


No doubt there. It's just that providing a secure platform seems a tad more important.


PHP has always ben slow, its getting slightly faster, but still REALLY, REALLY slow for anything CPU heavy. This is why the ML crowd sticks with Python (numpy) thats incredibly fast.

PHP is still lacking, there is no unicode support, and for a web language this is really bad. Also, the way PHP functions, makes modern web (like websockets) use impossible, there is hacks around this but they all kind of suck.


Python is slower than most of the horses I bet on. That's pretty slow.

The important - CPU intensive parts - of numpy, pandas, pytorch, and all the other "fast python" libraries out there, are actually written in C.

Pure python should not be used for anything that requires good performance: it is programmer ergonomic, not CPU ergonomic. It is great that through the use of FFIs it has access to powerful libraries written in a language that isn't slow, but that does not make it as a language itself, fast.


Thats my point, pyton the is one of the slowest languages, and still have high quality, high perf libraries like numpy. PHP has no way to install deps that actually are written in asm/fortran or c.


PHP still has PECL[0] which is a huge collection of C extensions.

[0] https://pecl.php.net/


> PHP has no way to install deps that actually are written in asm/fortran or c.

https://www.php.net/manual/en/book.ffi.php is not enough for your needs?


PHP has decent FFI, nothing is stopping you from using the same libraries as you would with Python. Here's someone's quick hack as an example: https://github.com/dstogov/php-tensorflow

For an interpreted language PHP itself is ridiculously fast and the VM is rather small so you can use something else coughElixircough for parallellisation. I use it all the time for data wrangling stuff and database imports because it's robust, fast and PsySh is a pretty neat environment.

The array data structure is quite nice too. It's built on simple parts that are foundational to the VM itself, and very flexible, similar to lists in Lisp-like languages but without the seek lag when data grows due to the indexing.


PsySh

I’ll have to check this out.

Though not popular php can be a surprising decent scripting langauge.


https://psysh.org/

It's very popular, as in a lot of businesses use it, it's just not fashionable.

I think it's a great tool to have. It had gradual typing before it was cool. You can type in like a page of code including the layout and render whatever in a PDO-supported database on a web page, served by the builtin web server, which is great for data exploration and things like SQL optimisation. At the moment I'm handling some data flows and conversions in a project with something like a terabyte of email and office documents that need to go into RDBMS, because there are some liberally licensed lightweight libraries (in contrast to the bulky stuff in Jakarta-land) and the performance is good enough to not be a bottleneck.

Edit: And when a library isn't good enough, I can usually trivially fix or extend it because it's in a familiar language and written by a simple minded person like myself.

There's a degree of clunkiness and incoherence in built-in API:s that might be off-putting at first but the included batteries and PsySH make for a quite decent tool anyway.


There were many many times I'd start writing a bash script, but then switch it to a PHP script. I've done this so many times that now I just start writing in PHP.


> This is why the ML crowd sticks with Python (numpy) thats incredibly fast.

That is not why.

You stick to python because it's your common denominator. You all picked it up in school.

Python the most popular language around, and one of the slowest.


Actually PHP itself is very fast compared to Python, especially for an interpreted language.

Python only seems fast because all the heavy duty number crunching libraries are actually written in C.


This comment and all siblings fight over PHP vs Pyhton etc, but that just isn’t the bottleneck in most apps.

By far, for most apps, the biggest bottleneck is the database.


Yet, just a pip install away. In PHP this is not possible.


http://pecl.php.net/packages.php

`pecl install Tensor`?


Just a composer require away.


I'm pretty sure this is wrong. PHP has been faster than Python for a long time, but numpy is not written in Python, it's written in C. Just like PHP, coincidentally :)


Python is also written in C.


Its not wrong, numpy is a pyrhon package (written in c) but you can USE it just with an pip install.


I tend to use PHP for my backend work.

In my experience, it’s actually very fast. That may be partly because of the way I write the code, though, and my backend code isn’t really too massive.




Consider applying for YC's Summer 2025 batch! Applications are open till May 13

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: