that's the issue, PHP should be secure(ie restrictive) by default, Linux style... it is not. PHP+Apache => recipe for disaster. PHP is a templating language yet doesnt do html sanitizing by default !
95% of compromised websites are PHP ones.
That's the reason why PHP will die eventually,when businesses understand while it's cheap to go online with a PHP cms, once you get hacked , it will cost you your business.
Agree, BUT, people should not use absolute statements (like "just use" or "don't use") cause sometimes (sadly) it easily leads to a religious approach.
The point of "just use" in this case is the implied, but often unstated, first part: don't learn crypto, just use _____. Because when you think you've learned "enough" crypto to know what to do (whether writing a library or just picking one), is exactly when you're the most dangerous. Either really learn crypto (i.e. the 10000 hours way)--and don't build any cryptosystems until you have--or just avoid the problem-space altogether, and do exactly what the experts tell you. Which, in this case, is "use bcrypt."
The experts don't say "use bcrypt" because it's the best pluggable key derivation function. They say it because it's a satisfactory key derivation function, with viable APIs for every language you can think of. It's the McDonalds of crypto packages: a known quantity, anywhere you want it. Which is exactly what you want to point at if you want people doing as they're told ("just use...") instead of trying to learn what a "pluggable key derivation function" is... and following that path until, inevitably, they become dangerous.
An analogy, to take that last idea further: imagine if there was a universe like that of Harry Potter, with young witches and wizards capable of learning powerful, dangerous magics. But these magics require no wands, nor any other implement or component that could be taken away from the magician; once the spells are learned, they are irrevocably in the magician's possession, even if the corresponding safety lessons for use of that spell are never absorbed. And then, imagine that most learning of magic occurred through autodidacty...
That's strange for hn because it's known that in a vast and rich sea such as the IT world, stability leads to a slow/fast failure or disappearing. They'll have to innovate, for their business and for the users.
And yet the reverse is true too. Over-innovating which I see as almost universally putting form ahead of function kills web enterprises dead too.
I think craigslist is a great example of success going with the most minimal "innovation" - in the last ten years I can think of two changes there, and one wasn't even voluntary. First, the map-view for housing listings and second the giving up of sex services to other sites like backpage under threat from a bunch of point-scoring district attorneys.
