>Having said this, I've found limited proof that a particular language is any safer than another as it comes down to safe coding policies and risk mitigation strategies.
Proof is right there in the article. To have PHP on the live server is a security risk, period.
Why would they have a host with PHP installed on the same server where money is handled?! Totally irresponsible.
I'm being serious. Unless you have Facebook's resources (and probably not even then) DO NOT USE PHP FOR ANYTHING THAT REQUIRES SECURITY! If you are, start a migration process today. Whatever you think it'll cost, it'll be worth it.
If you cannot decide from the billions of choices out there, go with Go. It's hardly perfect, but way better and simple.
"If PHP developers are made to feel terrible, they will leave and there will be less and less great developers working with PHP."
I don't quite see how this might be a problem. Does the author think those people would be less great in another environment? Does PHP own these people?
"Often times, people are just complaining about PHP because it’s a popular thing to do."
No. We do not complain about PHP because it's popular. We complain about PHP because it sucks and we are forced to use it.
Many of the so-called 4th generation languages (i.e. business shits derived from Cobol with DB support bolted in) are totally crazy in this sense. Not only are identifiers often case insensitive, they can also be abbreviated!
Yet people make massive amounts of money with them.
PHP seems to fall apart in the seams when trying to reach a higher abstraction level. For instance, Symfony 2 tries very hard to include modern OO techniques in there, but the end result is that its performance is incredibly bad. Also, the OO basis is ripped from Java (which is not a perfect fit in some places, given that Java is a more static language), which I do not enjoy at all.
Python isn't the fastest dog out there, but doesn't fare so badly with the abstractions, and its OO style suits a dynamic language better. It doesn't try to be a Java.
Neither language will give you much protection against programming errors, nor optimize your code very well like many of the new hip languages (Rust, Go, Nim) do.
"Poor people today have it easy because they can get government benefits without doing anything in return" vs "Poor people today have hard lives because government benefits don't go far enough to help them live decently".
If you focus on the latter part of the sentences, I can see how it's easy to be a bit confused about which is the correct answer.
>I wonder if keeping CVS is not one of the smartest things the OpenBSD project does now.
Given that OpenBSD is supposed to be a security-oriented OS, it's slightly weird that they are using a version control system that does not guarantee that what you put in the repo actually stays there, unchanged. Git guarantees that.
> They are arguably one of the best projects at doing it.
Even though I fully know that I'm being superficial and silly, I cannot help but find it hard to take seriously projects that do not use either git or mercurial for the sources in 2015.
Learning Haskell adds to the mass of things you know, and the volume of that mass determines the level of your general expertise.
You asked for tangible things, but it's harder to see what those may be. Perhaps your perception will be enhanced: perhaps you will better see and care about side-effects, opportunities for pure functions, etc.
I don't think any learning effort that leads to increased knowledge can be a waste of time.
>one of which became rather infamous years later lol
mtgox? :)
>TBH if a "developer" cringes their nose at a very capable tool, just because it is not the latest "cool" thing, It tells me a lot about them.
This is called the straw man fallacy. You wrongly assume that the lack of coolness is why people dislike PHP and you dismiss the whole argument based on that.
Doing great stuff with PHP is like building a skyscraper using nothing but a hammer and a screwdriver and a few rotten planks. It's the builder who's amazing (albeit a bit crazy), not the hammer, the screwdriver or the planks. Imagine what he might've made with proper equipment?
Proof is right there in the article. To have PHP on the live server is a security risk, period.