Have you ever seen how shared hosting works for some of the languages you mentioned? For Node for instance it’s the same as PHP, you upload an index.js and that’s it.
Comment on How is the security level of PHP in 2023?
bus_factor@lemmy.world 11 months ago
Some things got better. The magic variables, the killer feature which popularized PHP and also introduced the most vulnerabilities, has been gone for more than a decade. It’s not nearly as easy to accidentally make a vulnerability now. WordPress is still horrific, though.
But the reason PHP is still around is simple: There’s not much competition. mod_php is still by far the most convenient way to run shared hosting. You just install the module, and people can put .php files on their website and it just works. No need to set up FastCGI, some servlet engine, reverse proxy or any of that jazz you need when using python, ruby or node.js.
Sure, if you’re running your own VM somewhere, you can set all that up, but a lot of people are still on cheap, shared hosting, where all they can do is upload files via FTP. The only real scripting language which doesn’t need any server software configured is PHP, so that’s what those hosting providers support.
lemmyvore@feddit.nl 11 months ago
bus_factor@lemmy.world 11 months ago
I may be out of date on node.js. What is the price point for that? I’d imagine they’ll have to fire up a separate interpreter for each customer? I’d expect that to be more expensive.
The point here wasn’t really the user experience, though, but what is cheap and easy to support for a company providing bottom-tier shared hosting.
lemmyvore@feddit.nl 11 months ago
It’s not more expensive. Shared hosting pick a fixed capacity and they try to cram as many customers as possible per shard. That includes shenanigans like putting two resource-intensive accounts on one shard and 50 low-resource accounts on another even though they’re all paying for the same tier.
Yes with Node you have a process per account but it’s easier and cleaner to manage resource limits like that.
Overall the cost of shared hosting with Node or PHP is the same, what you don’t do is offer both at once because it complicates things. Typically you let customers choose the backend language option (PHP, Python, Node) and a database engine (MySQL, Postgres, Mongo) and that’s it.
redballooon@lemm.ee 11 months ago
Thanks! That’s the sort of answer that I hoped for.
Potatos_are_not_friends@lemmy.world 11 months ago
WordPress is still horrific, though.
Not wp core, or the latest core themes.
Everything where users can contribute, plugins and themes can be garbage. Especially on the open market. But as for php development of core… well kinda nightmarerish. But modern theme development with php is a great experience.
Modern themes also recommend moving the frontend templating to JavaScript.
Nearly 99% of my security audits on wp sites is looking for vulnerability from a decade ago.
In terms of security, WP core itself has been incredibly stable.
StreetKid@reddthat.com 11 months ago
Apropro WP: lemmy.world/post/6582047
Vlyn@lemmy.zip 11 months ago
I mean you still need to configure the webserver to handle PHP (Apache, Nginx, or whatever). It’s not active by default.
But of course for a webhoster that’s really easy at least.
bus_factor@lemmy.world 11 months ago
Sure, I guess I should have phrased that as “any additional server software beyond the webserver itself”, but it’s kind of a mouthful. And people would still get after me in the comments, because actually, that’s technically true for CGI as well, although the poor performance makes it a no-go for anyone doing anything commercially.