What is Reddit's opinion of
Hack?
From 3.5 billion Reddit comments
45 reviews of this app found across Reddit:
> It boggles my mind having left engineering at Facebook only 2 months ago that > the outside world still largely seems to write PHP like it’s 2009.
> It seems like people have never heard of Hack, HHVM, XHP…
First, not everyone is like facebook nor wants to use shitty facebook software.
But even more importantly - hack is another programming language right?
So if php was so great, why did facebook feel a need to write another language?
I mean this is mostly php or perhaps even pure PHP, just with some changes such as type annotations.
<?hh class MyClass { const int MyConst = 0; private string $x = ''; public function increment(int $x): int { $y = $x + 1; return $y; } }
So ... no.
There is only one sane way to use PHP "like it's 2009".
Use a better programming language.
Already in 2009.
The things people hate about PHP have been documented extensively. But as for alternatives, checkout Hack, built by Facebook. It's derived from PHP, but with some major improvements:
Data types
Hack allows data types to be declared. Not only does this help prevent bugs, but I'm far more productive with this because the autocomplete feature in my text editor becomes a lot more useful, because the text editor knows what data type is in each variable and can offer better suggestions for autocomplete.
Collections
One of my biggest gripes with PHP is how arrays are done. In PHP, an array can be a list of values like this: array('red', 'green', 'blue'); or a list of key/value pairs, like this: array('foo'=> 'bar', 'baz'=> 'blah');
That makes it confusing later in your code when you see an array. What format is the array? In Hack, there are different types of collections for each format. You get Vectors, which are like the first example, and Maps, which are like the second example, and they are typed to contain specific data types. You know exactly how to handle each one, because you know the structure and data types of the data it contains. Also cool is the ability to make the Map/vector immutable. So if the values aren't supposed to change, you can make it immutable to prevent accidental changes to the values.
Async
Most non-trivial web apps involve some third party API calls. These are time consuming requests over the network. Hack can do this asynchronously. That is, it can fire off the request, move on and do other things while it waits for the response, then catch the result.
Those are just some of the highlights. PHP7 is a major improvement, but still lacks some things I like about Hack.
Uhh, Facebook deprecated HPHPc two years ago (mentioned in the article you linked had you bothered to read it instead of just running a hate on)... They now use:
Which is basically PHP++
PHP7, on the horizon, borrows heavily from Hacklang. The PHP ecosystem is now, basically, PHP7 and HACKLANG competing against each other, and tackling valid criticism from it's detractors. From this competition, PHP developers benefit. The PHP ecosystem has evolved heavily in the last few years and in no way can be said to "hold someone back," unless of course they don't know what they are talking about...
Regards,
As other commenters have pointed out, user input just has to be validated before you can do stuff with it.
It’s surprisingly simple: the compiler sees that you’ve done a check and inserts an implicit object that indicates the check was done; if you try to call a function that requires such an object, and you don’t have one in scope, you get a compile error.
Natural use cases for dependent typing come up all the time. For instance, with null checks:
x = try_to_get_frobnicator(); if (x != null) { x.frobnicate(y); }
Dependent typing would let you turn this into a compile error, rather than a runtime error:
x = try_to_get_frobnicator(); x.frobnicate(y); // error: no proof (x != null) in scope
I’m patiently awaiting a usable dependently typed imperative language, but it’s still an open research problem. [ATS](https://en.wikipedia.org/wiki/ATS_(programming_language\)) is the closest thing I know of out there right now. Facebook’s Hack language also supports a limited form of this, presumably to help migrate codebases from PHP.
Origin stories
"We all went into the woods with pens and pads of paper and ate hallucinogenic berries we found to come up with ideas. Someone suggested two equal signs followed by a greater than sign and we all burst into uncontrollable laughter."
Personally, I'm very excited to see what PHP 7 brings. I'd wait and see exactly what the differences and tradeoffs are once the product crystallizes a bit more before deciding to switch back to it, though.
One of the big things that HHVM has that PHP 7 won't is support for the Hack language. Facebook has shown that they are committed to maintaining Hack with the community for the long haul, and I feel like it's an incredibly attractive alternative language for PHP developers who pine for a type checking system and a little bit more static analysis, as well as builtin async functionality.
That said, I'm sure PHP 7 has some exciting features to offer that will be worth visiting. We'll just have to wait and see!
http://hacklang.org/
Oh alright, Google cache of this posts link.
What do you mean? Hack still keeps direct compatibility (in terms of interface) with standard PHP library functions. There are some things they left out intentionally that are overall problematic or the source of way too many bugs, so there's that.
The people commenting that JavaScript is "just a scripting language" have obviously never heard of Atwood's law.
And, not to mention, with Facebook using PHP (well, actually, Hack), can you really just dismiss the two languages as "just a scripting language"?
And for those saying that JavaScript is just a scripting language, I'm wondering, do they write code in Java, Scala, C#, which, I find, many claim that those three languages are "real programming languages"? Well, guess what: those are all JIT'ed languages just like JavaScript and PHP, all of which are turing complete.
Then are those also just "scripting languages"?
> The lambda syntax. Come on. FB, you invented a totally unfamiliar syntax for this, and it's totally verbose.
The first example seems silly, but if you don't need a function that returns a function they're rather compact: http://hacklang.org/manual/en/hack.lambda.examples.php
> and then what the heck is ==>?
At the language level, Hack is to PHP what Typescript is to JS. They key difference is its dependency on HHVM, and there's no reliable Hack to PHP transpiler.
I like types too, so I made Psalm. It uses docblock types and whatever other typehints you give it to better analyse your code. It's deliberately stricter than Phan, and has the equivalent of TypeScript's noImplicitAny option, so that it can be configured to raise an issue any time it cannot safely infer types.
Ok, let us look how facebook is doing it lately: they (not so) recently released Flow and Hack, two static typecheckers for dynamically typed languages.
Hence why gradual typing, in all its form, seems like a subject worthy of your interest. :)
Racket is probably a very good example (and their contract system might also interest you).
Some code quality questions. Are you using:
- A proper template system with automatic escaping and automatic CSRF protection?
- Prepared statements and parameterized queries (exclusively)?
- No HTML mixed into the PHP?
- The MySQLi or PDO extensions, as opposed to the deprecated MySQL extension?
- Ensured that the web root is read-only to the PHP user, and owned by a different user?
- If you store passwords, do you use a modern hashing algorithm such as bcrypt, scrypt or Argon2?
- Do you have a policy for reporting of security vulnerabilities?
- Cookie-only sessions?
- Have you considered all other security issues in web development that you know of, including all of the top OWASP vulnerabilities?
- Have you thought of using HHVM and Hack for better performance and faster development, respectively?
Most importantly, will you ensure that users do not need to give you their password, and use something like OAuth2 instead? Giving you the password would be a major no-no.
Can't people just rename Hack to PHP10? It's an easy way to get a much better language essentially for free.
Existing PHP codebase is shitty. Trying to fix it is not productive. But Facebook painstakingly reimplemented it in a better way and designed a better language as well, so why not use it?
/u/inthesunsetmeonfire is wrong, Facebook is in open source space since years ago. Their "HipHop for PHP" compiler project started six years ago. Similar with Cassandra which was open sourced around the same time and today is used other places (f.e. Netflix), Hive and Thrift. Also check their Open Compute Project. And their new Hack language, which is a type safe superset of PHP.
This has been done. By Facebook no doubt:
In addition, most of the backend systems for Slack are all written in Hack.
Like /u/Molehole said, Facebook basically rewrote it into a language called Hack. They also wrote a VM called HHVM that runs their Hack code.
The criticism of PHP itself usually boils down to a few things like inconsistency in language design and security vulnerabilities. They're all things that can be worked around, but shouldn't have to be. PHP: a fractal of bad design is a very interesting read you should check out.
In my opinion, the only way it would get better is if the whole thing was scrapped and redone from scratch. The end result, if it was good, would not be backward compatible and wouldn't be "PHP" anymore. Hack is doing something, but I don't think it's enough. Probably because they (at Facebook) need to stay compatible with PHP as they transition. Just my opinion though. I guess I'm one of those "no hope for that" people, but I don't make a living writing PHP code either.
I find my perfectionism to be the main reason I try to avoid PHP. I perfectly understand the notion that PHP is the fine tool for its job, but the little imperfections and the fact that other languages got it so much better makes me feel left out, stuck in a dead-end job with mostly shitty projects because most talented people migrate to other tech stacks.
And please, stop mentioning Facebook because "they used PHP and look where it got them". Facebook build their own language superset of a PHP (Hack) with strict typing and a VM with JIT compilation. If you think that your project may reach Facebook's scale, you'd better think about switching to more performant and scalable solutions early.
Facebook manages to scale in spite of their platform choice, not because of it. PHP/MySQL was a reasonable choice when it was a one-person dormroom project, but they got popular, grew exponentially, and never had a chance to rethink their initial archtecture. Now they're stuck with it.
They've had enough difficulties that they went to the trouble of writing a new runtime and a separate PHP-subset compiled language just to try to get up to the performance levels they need. They're also have their own fork of MySQL for the same reasons.
PHP and MySQL are both designed to be novice friendly, relatively conceptually simple, relatively easy to deploy, etc. In order to meet those goals, they both make tradeoffs that make them poor fits for extremely large scale projects. It's not impossible, as the Facebook example proves, but it is significantly harder than it has to be.
While there's some truth in that (a lot of the engines in current AAA games are, in one form or the other, variants of older game engines, which are in turn variants of even older game engines, which were built in C and C++), I'd be hesitant to say that this would mean that the change was impossible.
However, when you have a complete code base written in one language, rewriting it in another language is very expensive, brings no immediate benefits to the users and takes a long time. So, companies invest heavily in improving existing languages. For example, instead of rewriting their code base in something more sensible than PHP, Facebook opted to make numerous improvements to PHP with HHVM and Hack, which is both cheaper and brings immediate improvements.
Translating that to the gaming world - dozens of big companies invested tens of thousands of man hours and millions of dollars into making C and C++ code run as fast as possible. Changing to Java or any other language would mean throwing away all of that in exchange for no immediate benefits. Could it be done? Yeah, sure. They could also rewrite it all in Python or another interpreted languages and sink even more money into making it run natively. But why would they do it? They already have a code base that works, and in most cases, works good.
I agree. There are plenty of reasons not to use PHP, especially when there are drop-in replacements with full interoperability.
I'd rather use anything other than PHP, and I have a particular tendency toward static types.
If you already have software and devs in PHP have you looked at hack and the HHVM?
Hack was developed by Facebook, which had an extensive PHP codebase and wanted to update without throwing everything out all at once. They have a compiler to convert your existing PHP into hack too so you won't have downtime while you clean things up.
After you have a more stable platform look at the technologies Google, Twitter, LinkedIn and Facebook created to do their data replication and storage. HBase and Cassandra come to mind although there are dozens more.
Python is like PHP, good for getting yourself up and running, but ultimately it's difficult to keep it running at scale. I've worked with Go for over a year on a data storage project and have mixed feelings about it. It's fantastic for web services but you wouldn't want to use it for much else; it would be worth looking into in your situation.
If they were to rewrite I'll bet they would choose a typed language rather than PHP, just for the sanity it allows when so many devs work on it. Or, use hack. For storage, something distributed, fault tolerant and available like Cassandra. For responsive and light frontends, I'd probably go with React.js.
Now, note that each of these were developed by Facebook. Google has their own with golang, BigTable/Spanner and Angular.js.
Both of these companies realized the same things and built essentially the same stack to deal with huge amounts of data, people and developers all while trying to do it on a shoestring budget. So, if I were to build a new one I'd go with what they're using now. Nothing else really comes close to those technologies for large web services.
Cheers!
For the strong typing you might like Hack with HHVM.
I would also second PHPStorm. It's a true IDE and it sounds like that's what you are looking for. Also don't forget about XDebug. This will give you that "real" debugging environment.
We heavily modified PHP to make it pretty pleasant. Most built-in functions see little use, and the type issues go away with Hack. If you haven't looked into it, here is an in-browser tutorial: http://hacklang.org/tutorial/
Yeah at least PHP is still in development, whereas development of VBScript stopped many many years ago. PHP is okay if you know the parts to avoid.
Facebook's Hack fixes some of the major issues with PHP (not all of them, but some of them).
Facebook uses their own version of PHP called hack, actually. Anyway, they don't care about your choice of language. If you're more comfortable with PHP then just use PHP. More people are familiar with Java though, so it might be good to have that as a back up in case your specific interviewer is unfamiliar with PHP. (They'll probably be willing to work with you around that though, or at least be able to read PHP.)
Engineer on Hack here, glad to see folks excited about it! Happy to answer questions here if folks have them, and we also watch the "hacklang" tag on StackOverflow if you have specific questions that are appropriate there.
A few notes:
- Most of the type system of Hack is enforced by a program separate from HHVM that you have to run, see http://docs.hhvm.com/manual/en/install.hack.bootstrapping.php. This is kind of confusing and I'm working on making the process better here, but that's the way it is right now -- you need to be running the separate
hh_clientprogram if you're using Hack, otherwise you aren't getting any of the benefits of having a static type system! - If you just want to get a feel for the type system, http://hacklang.org/ has a demo and tutorial that includes a cross-compile of the typechecker into JS. (It's actually the full typechecker running there!) No HHVM executing the code, but it's a real quick way to try out some of the features.
- "Unsafe" isn't a mode but rather a way to say "hey typechecker just trust me about this" for a specific block of code, see http://docs.hhvm.com/manual/en/hack.modes.unsafe.php.
- We're actually neither a superset nor a subset of PHP -- we've added some things, but the typechecker disallows you from using some things as well, e.g.,
$$var.
> There's no reason to put effort into porting your great, big app over to Hack.
I'm clearly biased here, but I disagree :). Gradual static typing (via Hack) provides a huge win in maintainability and developer efficiency in my experience. It can catch bugs via mechanical analysis, but also get out of your way when you want to do something highly dynamic. At least for me, it was a hugely transformative experience when I wired the Hack typechecker into vim -- I would get yelled at about problems as soon as I saved the file, right after I wrote the problematic code, instead of minutes later during testing or days later for more subtle issues.
Facebook has also come out with hack, which is a language based on php for their hhvm. Places like Facebook and Twitter do things differently than you'll probably ever need to. They're huge, and for practical applications, you probably won't need to do what they do (at the level they do it), but it is a good idea to want to know how they do stuff. Here's a link I found that talks about how Twitter deals with their stuff.
http://hacklang.org/ They made a new language that is backwards compatible with PHP code. It was internally used to build a lot of Facebook, and they decided to release it to the community with documentation and tutorials.
Facebook does a lot of talks in the PHP community as well; many of which are VERY education and useful.
And what if Symfony isn't well suited to a project I wish to pursue? A stellar framework is no defense to criticisms leveled at a language. I'm not saying PHP has no merits. Its ease of use makes it an attractive choice for many, especially for projects of limited scope. Understand that your development needs don't necessarily reflect others though.
A telling example is Facebook. Having already invested significantly in a PHP codebase, they developed a whole suite of tools to improve developer productivity and code quality. Ultimately, they arrived at a new language, or dialect called Hack. There motivations?
>To ease the pain of PHP programmers without making them abandon the language and years of software development, Facebook developed Hack, a new, PHP-derived language that’s largely compatible with existing code and augmented with new safety features derived from functional programming languages and academic research.
A lot of those improvements are making their way back to PHP. That is great. I personally am still not particularly fond of it.
HHVM is not a diffident version of PHP, HHVM is a virtual machine / JIT designed for executing programs written in Hack ( and previously PHP too ).
HHVM is still able to execute PHP 5 code and it supports some PHP 7 features, but if you are going to use PHP 7+, its recommended to use the official interpreter, as PHP 8 will most likely get a JIT compiler too.
php 7.3 already have type hint, return type hint, strict type mode, good performance.
php 7.4 is coming with typed properties and FFI - also typed variables *wink*.
the only 2 things that i wish php had at this point that hack does, is generics and shapes.
Hack is a fork of PHP, but its own programming language at this point and taking a whole new different path.
I'm not gonna say any language is just better than any other, but I do want to mention that if you're considering PHP, you may want to consider Hack instead:
It's a super-set of PHP and what Facebook uses these days.
But that said, for most projects I would say Golang is the way to go.
There is always that one who doesn't get the sarcasm.
Also facebook doesn't use php as you know it, it's called Hack. And they're also rewriting a lot of stuff to use c++.
Sure, I was under the impression we were making a distinction between creating something and contributing to it. It's certainly reasonable to say that Facebook has contributed to the stability of memcached.
Also, I'll clarify that they now call the language used on the hhvm hack(http://hacklang.org/).
I'm not quite sure what is blocking the Flow type checker from working on 32 bit boxes. I have a hazy memory of someone telling me the reason. The Flow type checker is built using a bunch of infrastructure from the Hack type checker, and probably some piece of that (maybe the shared memory?) assumes 64 bit. This was probably not a big deal for Hack, since to run Hack you need HHVM and HHVM only runs on 64 bit.
In any case, I've opened a github issue to track this. Thanks for reporting!
This has actually changed a lot. They now use Hack (http://hacklang.org/) which is their own language. It's also worth mentioning that they run their PHP through HHVM (http://hhvm.com/) which compiles PHP down to native code which makes it a lot faster.
Of course they're using Memcache or some other cache library. It's also interesting to see that they're using Go too.
It's worth mentioning that's not to say that Ruby, Python etc.. aren't used internally. Most companies are polyglots.
Technically, you are correct; Facebook was written in PHP. However, the irony of that very statement is that Facebook has gone so far with PHP they are putting a good deal of resources into making tools to improve PHP beyond what it is capable of.
They created a new compiler for their PHP code, and I quote, "HHVM has realized over a 9x increase in web request throughput and over a 5x reduction in memory consumption for Facebook compared with the PHP 5.2 engine + APC."
They also created a new language called Hack, the goal of which was to have code that was interoperable with their PHP code on the HHVM, while bringing in features many other modern prog langs have.
Theoretically, if Facebook was originally built on a more robust language, these things wouldn't have much of a need to exist at all for them, but they had to bring PHP up to the standards of other languages. Most importantly though, like I said in response to Adiost, talented people can still make great things with shitty tools.
Weak typing, and the fact that it's an interpreted language make maintenance of PHP code difficult. The maintenance developer will get no help from a compiler when writing code to suggest how an object ought to be used, and if they use it incorrectly, they will have to run it to find their error (assuming the error is encountered while developing. If not, then it will remain in code as a bug.) The fact that it's a server-side interpreted language also makes debugging more difficult (if you've ever inserted echo statements to PHP code to diagnose a bug, you've experienced this.)
Those are all maintenance issues though, for writing something simple from scratch and running it, skipping the steps of compilation and the overhead of declaring types can be fun for fast prototyping or the creation of small code units. This is exactly why I love using Javascript. Essentially, the stronger your language, the harder it is to write, and the easier it is to maintain.
That said though, if PHP works for you, then don't be afraid to keep using it. But I'd also recommend researching alternatives to be sure you're really using the best tool for the job.
RE: What language I'd recommend in its place: I personally use C# on .NET, but that ties you into the Microsoft ecosystem heavily. Typescript on Node.js would probably be my fall-back, and you might also take a look at Hack which, as I understand it, is Facebook's attempt to shore up some of the weaknesses in PHP: http://hacklang.org/
> You can not, in any language, test for people using you library in ways you did not intend.
that is certainly true, but you can avoid many pitfalls with static typing. Larry Wall introduced optional type info in Perl6, and the people over at Facebook created their own language to get rid of these problems, i.e. the "typed" PHP Hack.
the upper bound on the types that you get with static typing does provide some safety; which is hard to replicate in a dynamic langue without doing manual type checking i.e. import types and so on.
in order to abuse a method/function in a typed language you really have to try hard, but you do get much less code in a dynamic language which can be well worth it IMO.
Facebook's Hack supports some similar methods on its Map and Vector collections:
$foo ->filter($x ==> !empty($x) && strlen($x) > 6) ->map($x ==> substr($x, strlen($x) - 6))
The execution isn't deferred like LINQ though, and they are just regular methods of the collections (so not as easily extensible as LINQ is with LINQ providers). That and the language is based off PHP so it's still got some of the PHP ugliness :)
We've also open sourced the tools we used to do the conversion at Facebook. They're even included in the default install if you are using the debian or ubuntu nightly packages. See the documentation for them here: http://hacklang.org/manual/en/install.hack.conversion.php