There and Back Again

I passed the ZCE exam this morning. Wasn’t that hard of an exam, though there was lots of code reading, with little errors to detect.

The conference has been off to a slow start, but i’m in Ilia Alshanetsky’s State of PHP Security talk and it seems that were off to a good start.

The focus of the talk is on the security of the core language, the talk started with the state of PHP security at the beginning of the year. And I think the best way to sum it up is that PHP wasn’t taking a proactive enough approach. The good news is items like the Month of PHP bugs got people to react and things have gotten better.

Improvements:
Automated code analysis (Coverity)
Tests for all security bugs, and lots more tests in general (There is an IBM developer writing 10-20 unit tests a day).
Valgrind memory checking
Code coverage using gcov
Fuzzing
Giving credit to security researchers

The good news is tons of vulnerabilities have been fixed in 5.2.x series. The even better news is most of the vulnerabilities aren’t easily exploitable.

The talk made me feel better about security issues overall, its all part of PHP growing up but I wish PHP would have been taking this more proactive security approach years ago.

Ilia’s slides should be available in the next couple days from his site.

I’m starting my second day here at ZendCon, its the first real day of the conference, yesterday was a tutorial day. There were a lot of good tutorials going on, i spent my time in the Zend Certification crash course since i’m taking the test to get my ZCE today (the test was included free with the conference).

From the crash course the ZCE doesn’t seem to hard if your an experienced php5 developer, but it does seem that you need to pay attention when reading the code examples.

I had a chance to talk with a lot of people last night, it looks like the conference is off to a great start, if your here make sure to look me up.

The last few weeks have seen a number of new features added to WebThumb. These changes have been little things like a new usage graph on the website to more exciting thing like excerpts and really tall snapshots.

Excerpts

With thumbnail excerpts you can get an image from visible part of the webpage. This is on by default and grabs a 400×150 image from the top left corner of the website where most people’s logos are. Using the API you can specify an excerpt from anywhere. Note that if you take a excerpt that is larger then 800 wide or 600 tall the request will cost an extra credit.

API example of customizing an excerpt

<webthumb>
    <apikey>apikeyhere</apikey>
    <request>
        <url>http://blog.joshuaeichorn.com</url>
        <excerpt>
            <x>0</x>
            <y>15</y>
            <width>1024</width>
            <height>120</height>
        </excerpt>
    </request>
</webthumb>

Sample Output

API example of fetching an excerpt

<webthumb>
    <apikey>apikeyhere</apikey>
    <fetch>
        <job>wt46fd34663e680</job>
        <size>excerpt</size>
    </fetch>
</webthumb>

Tall thumbs

The API has been updated allowing you to request thumbnails up to 2048 pixels high. This value could be increased in the future if there is demand. All thumbnail requests over 1024 pixel cost 2 credits. Note that once you use any 2 credit feature (large excerpt, tall thumbnail, full size output) you can use the others for free.

To make a tall thumbnail you just request set a large height in your request.
Example

<webthumb>
    <apikey>apikeyhere</apikey>
    <request>
        <url>blog.joshuaeichorn.com</url>
        <height>2048</height>
    </request>
</webthumb>

Example Output

Full size snapshots

Full size snapshots aren’t a new feature, but they haven’t really been advertised. All you have to do is a fullthumb tag to your request and you’ll get an image that is the full size of the browser. Fullthumb requests cost 2 credits.

Example fullthumb request

<webthumb>
    <apikey>apikeyhere</apikey>
    <request>
        <url>webthumb.bluga.net</url>
        <fullthumb>1</fullthumb>
    </request>
</webthumb>

Sample Output

Other Stuff

• Image resizing on thumbnails has been updated so if you pick non-standard dimensions for the browser you’ll get back thumbnails with the same height/width ratio.
• The result from a request now includes the credit cost, so you can tell if you were charged for a fullthumb etc.
• Bulk rates are available for people making over 2500 requests a day, contact me to find out rates.
• Older thumbnails are being deleted from the system, the length of time that thumbnail are stored will decrease as webthumb usage continues to increase but it shouldn’t go below 48 hours.
• A tool for testing the API has been added, it lets you make API requests to learn the API without doing any setup.

Things have worked out for me to go to ZendCon this year (thanks Helgi). If your going to be there and want to talk about anything PEAR, WebThumb, or AJAX related let me know and we can make plans to meet up.

Also I’ll be giving a talk during the un-conference about PEAR2.

WebThumb has been moved to a new server. Right now its running 4 times the processing capacity of the old server. I’m looking into ways to expand that capacity further as needed.

The only outstanding issue is getting the PDF plugin to work again, hopefully that will be fixed by the end of the week.

I’ve been slowly moving all my websites to a new server. Today I moved email. If you try to email me today and I don’t answer there’s a chance thats way. It could also be because I didn’t want to respond .

Yesterday at azPhp I gave a short presentation about the benefits of upgrading to PHP 5. The slides for cool things in php 5 are available. If you goto the single page view you can see the notes that go with the presentation, there are article links for most items giving more details.

The PhpDocumentor team hopes to release the final 1.4.0 stable feature release on 7/20. If you have test-driven any of the recent pre-releases for 1.4.0 (alpha1, alpha2, RC1, RC2), please let us know any good/bad feedback you have from that experience.

Changelogs:
1.4.0RC2
Includes no PEAR items:

Includes these Sourceforge items:
- [1733938] regression: “-” not allowed anymore in converter (file)name
- [1733936] “phpdoc” does not return with error code “0″ on success
- [1733345] inline @link tag renders wrong way
- [1722096] DocBlock template example does not work

1.4.0RC1
Includes these PEAR items:
Bug #11409: PHP Notices accompany Global Never Found errors

Includes these Sourceforge items:
- [1724990] @static tag example
- [1724884] object return parameter value
- [1720764] documentation update needed
- [1672589] missing elements, bad links with HTML:Smarty:HandS
- [1634153] require/include with concatenated file name
- [1632496] {@internal}} becomes wrong on documentation
- [1124133] <code> and @include….

1.4.0a2
Includes these PEAR items:
Bug #10864: PhpDocumentor dies when parsing illegal page-level docblock
Bug #10870: Dead links generated with HTML:Smarty:PHP Bug 10871: Wrong rendering of inline {@internal}}
Bug #10910: DOM templates create incorrect trees
Doc #10914: Can’t use nested tags inside or
Doc #10972: @method does not work
Doc #11032: param type1|type2 not documented
Doc #11143: Provide a Minimal Tutorial File Setup Example

Includes no Sourceforge items.

1.4.0a1
Includes these PEAR items:
Req #10670: Don't Die on Empty Tag Descriptions
Doc #10675: Clear some errors.html items
Doc #10730: Replace Sourceforge Trackers with PEAR

Includes these Sourceforge items:
- [1647423] memory_limit: bad if-clause
- [1622538] List undocumented classes/functions
- [1602988] Added --ignore-symlinks option
- [1588942] Allow memory_limit setting in phpdoc.ini
- [1588936] Show INI Path at Startup
- [1585840] Refactored RETURNs #3
- [1574047] Refactored RETURNs #2
- [1574043] Refactored RETURNs #1
- [1543289] Apply ignore patterns to subdir of dir, instead of full path
- [1543287] Use predefined PHP env var in phpdoc script
- [1540666] patch for @property, @property-read and @property-write tags
- [1044752] List undocumented classes/functions

This blog is running on a new server, you shouldn’t notice anything but faster performance but let me know if find any 404s

Rossp.org has a API Wrapper for Webthumb written in Python. If your a python user take a look.

If you’ve ran into problems with the menus at phpdoc.org in IE7 you should be good now.

I switched from them being CSS driven to them being jquery driven.

There is nothing like jquery for dom manipulation.

$(document).ready(function() {
        $('#nav ul > li').mouseover(function(e) {
                $('#nav ul ul').hide();
                $(this).find('ul').toggle();
        });
});

The PEAR group and president now have a blog. We will be using it to make announcements and to ask the community for feedback. I think this is a big step towards making PEAR a more transparent project.

I just quickly hacked up a theme for it so if you don’t how the blog looks you can blame me. Of course a more useful thing to do in that case would be to send me an updated css file.

If your a WebThumb user and would like to help beta test the new server please let me know.

The new server offers higher capacity and shouldn’t require any changes to your apps, but download urls have changed so i’d like to do some testing to verify that before I do the switch over.

Send me an email if you’d like to get involved.

Tuesday I did a presentation about PEAR at my local PHP user group. Those slides are now available.

I’m hoping to improve the slides a bit and give this presentation at lots of other places. If any PHP User groups on the west coast would like me to do a presentation about PEAR drop my a line.

If you’d like to give a presentation about PEAR at your local user group also let me know and I’ll give you a tarball of the slides, you just have to agree to give me back your updates .

I’d like to thank everyone who left a comment on my last post about How you would improve PEAR. You’ll be happy to know that were already working on many of your suggestions, Greg’s post on the subject has some more details. I’ll be sharing everyones comments with the rest of the PEAR group at our meeting on the 13th, so if anyone has a suggestion they haven’t submitted yet thats your deadline.

Out of all the suggestions the one I’m most excited about is starting a mentoring program to help developers get involved with PEAR. This is someone we were already planning on doing so now its just a matter of getting the details taken care of. I’m not sure if will end up with an official sign up for a mentor or some other process but until then, if your interested in getting started as a PEAR developer and want a mentor send me an email and i’ll find a mentor for you.

Also if anyone left a comment and it didn’t show up it got caught in my spam filters. I get about 500 blog spams a day so I can’t easily check the filter for false positives. If you think this happened to you shoot me an email and post again and i’ll make sure it goes through.

You might have heard that I’m a member of the PEAR group now. Because of this I’ve been spending a lot of time thinking about what I’d like to see changed in PEAR to make it a better project. I’m slowly building up a list of ideas and at some point I’ll share it, but today I’d like to get some feedback from everyone who reads this blog.

If you were a member of the PEAR group what would you change about PEAR. Please keep in mind were not an all powerful body (Read the constitution for details), but we do have the ability to set policy, and like in any open source project we can make changes through our direct actions.

Thanks in advance for your comments.

The PEAR elections start tomorrow, if your a PEAR developer you’ll want to read people’s position statements so you can make an informed vote.

I hope these elections will be the beginning of the a rebirth of PEAR. It was a wonderful idea when it started but its been coasting for the last couple years we never did enough to embrace PHP5.

If your wondering what the whole election is about its pretty simple. A month or so again PEAR voted to accept a new constitution. This constitution, created a new position of President (Which only Greg Beaver is running for) and made the PEAR group an elected position (candidate list with position statement follows). The PEAR group’s job is to decide how PEAR should be run and too make this happen.

This election is for a term running May 1, 2007 to May 1, 2008

The following are running for the PEAR Group (Position statements are linked for their names)
Updated April 19th 2:45PM MST

• David Coallier PEAR Page
• Bertrand Mansion PEAR Page (nomination post)
• Christian Weiske PEAR Page
• Helgi Þormar PEAR Page
• Arnaud Limbourg PEAR Page (nomination post)
• Martin Jansen PEAR Page
• Paul M. Jones PEAR Page (nomination post)
• Joe Stump PEAR Page
• Joshua Eichorn PEAR Page
• Brett Bieber PEAR Page
• Stefan Neufeind PEAR Page
• Justin Patrin PEAR Page
• Mark Wiesemann PEAR Page

Some people haven’t replied with a position statement yet, so I haven’t linked to it, i’ll update this post as people’s emails make it too the list.

If I didn’t find position statements posts today I added a link to the post the person sent at nomination time.

The phpDocumentor team is just about ready to do a bug fix release. The code is sitting on the server and ready to be uploaded, we just want to get some extra testing done.

If you could install 1.3.2 do your normal documentation run, and leave a note on this post I’d be grateful. The bug fixes have all been tested but you never know what can creep in during the packaging process.

Pear download

pear upgrade http://bluga.net/projects/phpDocumentor/PhpDocumentor-1.3.2.tgz

Non-PEAR download (extract and go)

Update (2007-04-04) we made some small changes to the build, mainly making sure everything knows its version 1.3.2

Thanks to Greg’s efforts I’m now hosting a mirror of the PEAR channel. At the moment were only mirroring installer data not the entire website but its a start.

Things are still in the testing phase, but the mirror is usable, just run: pear config-set preferred_mirror us.pear.php.net

Right now we sync the mirrors every 4 hours, so it could be slightly out of date, but not enough to cause problems.

I found an interesting project, quercus that compiles PHP to Java Bytecode allowing it to run ontop of the Java Resin Application Server. It has a couple neat features, one being PHP6 compatible unicode support, the other being easy integration between Java and PHP code.

It also seems to perform well, implements a large part of the PHP api, and lets you implement anything your missing just be writing a new Java Class.

It will be interesting to see if a project like this can actually take off.