The PHP foundation’s response looked inadequate and not well coordinated. The exploit was leaked and the fix was neither expedited nor rolled out quickly. The consortium of companies that participated in the release were mostly interested in using this security incident as a marketing opportunity. The details of how the response was fumbled and how to improve it is something that will be discussed in the following days. PHP and other orgs have promised improvements to their governance and processes.

The fixes have been back ported to older versions of PHP by a third party who filled the gap left by the official PHP release cycle. Even then, for large parts of the internet the fix may never happen. The fundamental nature of PHP as a technology and the governance they can effect do not seem in any way suitable to the scale of the problem they have let loose on the world.

PHP’s nature is that as a programming language it is bad. It had a moment and that moment passed decades ago. Software is subject to a lifecycle. Perl is dead for all intents and purposes. Ruby is well past its prime and should be considered legacy software sooner rather than later.

The only correct answer to yesterday’s exploit as a professional software organisation is: “We don’t run PHP.” Nobody should be deploying PHP on the internet in this day and age. That a privacy focused enterprise collaboration suite such as NextCloud is written in PHP is laughable.

Large C/C++ codebases like the PHP one are fundamentally unsecurable. There’s nothing that tells us we won’t see 10 more exploits of this scale coming out in the next years. Every poorly maintained online PHP property should be considered to be toxic waste. Yes, that includes all of Wordpress.

The only way out is to either port the language itself to a memory safe language or to port your code to something less exploitable. Both manoeuvres are practical enough these days that there’s no excuse not to do it. Nobody is locked into anything anymore and it’s hard to believe that writing PHP in particular is the thing that makes somebody’s heart sing. I have no stakes in it but probably if all these people would just write Go, a lot of this could have been avoided. I moved this blog off Wordpress to Hugo with some help from Claude and it has been a blessing.

Open source maintainers often complain about their lack of resources to do the tasks they ‘need’ to do. Undoubtedly they are right, but since we only have so many resources to go around it’s probably better to cut and focus rather than try to keep every project alive and secure. One answer to a lack of resources and recognition can be to just drop the work. Why would you keep going while at the same time complaining about it? Most people who believe they can’t be replaced are entirely wrong.

We don’t need this many interpreted web languages. More generally we don’t need half a dozen open source libraries doing the same thing. Sometimes the mature thing can be even for a project that is very ‘successful’—especially if that success is by now mostly toxic—to consider the project finished, cut a final release and archive the repos.

https://werd.io/why-rss-matters/

This seems to have gotten stuck in my drafts with tons of other things. Fun to have a memory of the first UX Book Club meeting that I organised back in December 2009.

The show itself needs almost no introduction since it’s become a mainstream online phenomenon. Subway Takes features comedian and musician Kareem talking to NYC personalities who share their “takes” during brief subway rides.

He ventures outside of New York once in a while, and after London and Paris, has now turned up in Berlin.

The U-takes started with a masked party-goer declaring that “It’s actually good for you to party for 72 hours.” Next came local comedian Aurel Mertz with a pedestrian and mildly funny take about exercise. The party-goer made a return appearance after the aforementioned 72 hours of partying. And the latest episode features an American investor affecting an exaggerated German accent.

These three characters could not be a better reflection of the city of Berlin and where it’s at. A guy stuck in a party, unable to get out; a Southern German guy slumming it here until it’s not ‘fun’ anymore; and an investor mining the city for cash and clout. These are the people who shape the city, and for all of them, this place is a playground.

What I take away from these Subway Takes is that Berlin is a place where nothing matters and everybody is passing through. Could they have even found a real Berliner to talk to? That’s a question that’s probably best not even asked.