I wasn't specifically talking about security bugs, but bug is bug, so this applies anyways: Where do you think it's more likely a bug is found and fixed: In one of dozens of unofficial implementations or in the one official implementation?<p>"bloat" is not always bad (well. bloat is. but a big library isn't necessarily what I'd call bloated).<p>If you want to talk about bad parts in PHP, I could name a ton, but a huge base library isn't one of them.<p>Bad parts are:<p>- too much focus in backwards compatibility. A py3k like cut between php 4 and 5 would have done wonders and would not have made the adoption much slower (which was still very slow despite the more or less given backwards compatibility).<p>- wordy, inflexible syntax<p>- trying too hard to be like java while not being like java.<p>- inconsistencies in the base library (parameter order)<p>- very, very WTFy type conversion (IMHO the worst part of PHP)<p>But having a big base library is not what I would ever be disgusted with.