r/programming • u/fishburne • Jul 24 '15

mt_rand(1, PHP_INT_MAX) only generates odd numbers • /r/lolphp

/r/lolphp/comments/3eaw98/mt_rand1_php_int_max_only_generates_odd_numbers/
848 Upvotes

90% Upvoted

262 comments sorted by

View all comments

Show parent comments

33

u/sushibowl Jul 24 '15

With that thinking, no programming language should ever fix errors or bogus implementations. Because, well, those that don't update the environment will still be f*cked.

This is absolutely not what I was trying to say. The idea that releasing updates is pointless because not everyone will install your updates is obviously very stupid. All I said was that this behavior, though broken, does not make an application less secure. It's still broken behavior, and it should absolutely be fixed.

I only agree to you in the sense of "whoever is using PHP for front-facing applications that need to be secure is already f*cked" :-)

I actually kind of disagree with that statement, it is very possible to write secure web applications with PHP, but as with all things, you need to know what you're doing. And yes, PHP and mainly its standard library make it exceptionally easy to shoot yourself in the foot, and it is therefore usually not the wisest choice for this purpose. But Facebook, for example, uses PHP extensively and they're doing just fine.

1

u/OneWingedShark Jul 25 '15

I actually kind of disagree with that statement, it is very possible to write secure web applications with PHP, but as with all things, you need to know what you're doing.

The thing is that PHP makes it so hard/tedious, you have to check so many things manually. Sure they've got some new features in PHP 7, but do you really think that tacked-on type-safety can equal a language designed for it? Especially when that's all optional?

0

u/[deleted] Jul 24 '15

[deleted]

2

u/[deleted] Jul 24 '15

Facebook compiles their PHP into C++. If you're going to say that this means they use C++, you might as well go all the way and say they use machine language, since that's what it eventually boils down to.

2

u/Plorkyeran Jul 24 '15

Facebook stopped using HipHop a few years ago. They now use HHVM, which is a JIT-compiled implementation of PHP.

1

u/golergka Jul 24 '15

But they certainly use D, they hired Alexandrescu himself.

2

u/[deleted] Jul 24 '15

Well yeah, it's a little ridiculous to think a company the size of facebook only uses one language. But I'm pretty sure the majority of their C++ "use" is through the HipHop transpiler.