Made of Everything You're Not

Since I had to setup a whole new computer I decided to move away from the IIS experiment I've been working on for the last year and try something a little different. I'd heard about Zend Server CE before but after a failed attempt to get it working a few months ago, because of IIS ironically enough, I hadn't really given it the attention I thought it deserved. After having played with it for about a week I have to say I'm completely... underwhelmed.

Zend Server is supposed to be a complete Web Application Server that is purpose built for php development. It includes application monitoring, problem root cause analysis and and extended caching capabilities. Pretty enticing really.

Unfortunately, Zend Server CE doesn't include any of the above bells and whistles. Instead, it's a stripped down version that appears to just match the features and functionality of XAMP or WAMP (Apache, php and mysql wrapped in a nice little installer for Windows).

I've used both used both XAMP and WAMP and, with little exception, I've always wished I'd gone with a manual installation instead. It's not that they're bad programs, it's nice that they're available for newbies, but my needs aren't easy to package up in a "one size fits all" package. I like to try new things and experiment and sometimes what I want to do isn't easy without breaking something. Admittedly, I haven't tried to use any one size package for a few years so this may not be the case anymore.

Either way though, I know I have a bias; I might even be a bit of a snob about the issue. Totally possible.

That being said, after installing Zend Server CE, which went very smoothly actually, I was confronted with what appeared to be an incomplete installation of php; php-win just didn't work. It did nothing in fact; I couldn't get it to do a damn thing. Since I do a little maintenance scripting with php-cli (and php-win.exe is essential on Windows) this was a pretty big issue.

On top of that, I just couldn't figure out how to modify the --configure options so changing the setup was obviously going to be an issue. I don't know if I'm an idiot but I just couldn't figure it out.

Then the let down happened; I was under the impression that there were going to be some cool profiling toys to play with. Instead, there's a web GUI for configuring PHP, which is pretty nice I guess, but for me, it's just easier to edit php.ini directly than navigate through a web interface. Kind of useless. What with the integration with Zend Debugger I was really expecting more.

Ultimately, it seems that if you're a complete newbie to php Zend Server CE is a worthwhile fit but if you actually know what you're doing you're still better off setting up a development environment manually.

This is pretty disappointing. A product from Zend, that's supposed to ease the pain of php development being released to the community, offering nothing more than you could already get from a dozen other programs kind of seems like posturing. I understand the desire to have a demo of a paid product but it should, you know, be different.

A good change I'd like to see would be to include some of the more advanced features like the Application problem diagnostics and the Application monitoring (alerting) functionality in the CE version. It would benefit the community far better than the current version.

One BIG downside of leaving StreetWise was that I needed to give back the laptop I've been using for the last 2 years. I loved that thing; it was perfectly tuned and configured for how I work. On the other hand though I was forced to buy a new one which means it's upgrade time. Hooray!!

I decided to stay with Gateway for the brand and chose the NV52 which is twice as powerful as the last one. Of course it's also covered in stickers that proclaims my laptop include an
<blockquote>AMD Athlon X2 processor, ATI Radeon video, Windows Vista powered with Dolby Surround Room for sound. Gateway was also nice enough to include an additional sticker that includes the specific stats and configuration.

The flair on the computer is one of those decisions that has, near as I can tell, zero redeeming benefit for the user. It appears to be 100%, wholly dedicated, to making a couple extra bucks for Gateway.  It's hard to imagine the argument for how it could possibly benefit the user; if I were to try though I imagine it would be something like this:

No, no, no!! I'm telling you, the user's going to need to know what video card they have in the computer at all times. No, I don't think they need to know the model or anything to identify issues; knowing just the brand is all they need.

Ooh, it'd probably be a good idea to include as many stickers as possible too. Let's be sure to include them for as many different components as possible. Oh yeah, it's important to keep as little information on them as possible; just the brand logo if possible.

Silliness aside, I'm sure one of the arguments is cost; getting money from the hardware folks to put a sticker on a computer helps keep costs down. Well, fine but I just don't care about the stickers. It makes the computer look like a freaking stock car and I like a clean computer.

There's a nice article on how to remove the stickers that was pretty helpful on WikiHow. I went through the process laid out, and while a couple stickers were a little more trouble than others, it was a pretty straightforward process. Of course, now it's going to be difficult to know what companies sponsored the computer but life goes on.

I guess I'll just have to memorize that my computer has an AMD Athlon X2 processor with ATI Radeon video, Windows Vista powered with Dolby Surround Room for sound

Obvious statement; programmers are, at their core, are problem solvers. Yes, our output is code, but at the base level the entire process of creating the code is in response to some sort of problem. On top of that, once the initial problem is solved we're still responsible for fixing new, unknown, issues when they come up.

Solving problems is what we do. I was reminded of this the other day when a bug was logged about a project I'm working on.

The issue was that the tab ordering on a form, where you use the tab key to move between fields in a form, was skipping the select fields in FireFox on a MAC. Since I wrote the program the issue was reported in so the responsibility for fixing it fell to me.

Now, how would you solve the issue?

Assuming you took exactly the same path I did, you would probably attempt to replicate the issue and found that, yes indeed, when tabbing between fields in a form the order for the tabs was unreliable; it would skip all the select boxes. Seeing the proof, you might start looking into what could be causing it.

Immediately, all sorts of suspects come to mind:

1. The field "label" elements could be wrong.
2. The divs the fields are placed in are out of order
3. FireFox could just be broken (hey, it does happen)

As do a couple "simple" solutions that remove the issue without technically fixing the problem:

1. Set a dedicated "tabindex-n" in each field element. This could force the tab flow but it's not known if it will fix the issue .
2. Write FireFox specific JavaScript to force the tab order in that browser (costly but certain to fix)

You now sit at a crossroads of sorts; you can figure out why tabbing isn't working by eliminating suspects or you can attempt to bypass the issue entirely and use  one of the above "simple" solutions or you take door number #3 and do more research on the issue before making a decision on direction.

We've seen it time and time again; programmers eager to just jump in an start changing things, writing things, and just creating things. This is always, 100% of the time, no excuses, unequivocally the wrong move.

Doing, just basic, research on the issue produced this gem from CoolWeblog:

I just spent the better part of an hour trying to get tabindex to work under Firefox/Mac OS X.

The solution lies not in Firefox, but in the Mac OS X preferences.

Apple Menu > System Preferences > Keyboard and Mouse > Keyboard Shortcuts

and under "Full Keyboard Access" choose "All controls".

Sweet lord....

Attempting any of the above solutions would have been a HUGE waste of time; essentially just grasping for straws.

Well, it was bound to happen; I have left StreetWise. Yesterday was my last day. The split was amicable and on good terms; it was just time to follow my ambitions a little more selfishly. I love IT and hardware but my true love is programming and I need to do more of it.

I love StreetWise, and it'll always hold a place in my heart, it was just time. I wish them the best of luck.

Now I'm looking forward to getting in reverse sleeping patterns, focusing on me and get back into freelancing and contract work. I can't wait to focus 100% on programming and web development.

Exciting times ahead

Right now, and the last 4 years really, I use EditPlus for all my PHP development but from time to time I dip my toes in the IDE waters to see if I can make a switch for something  a little more... helpful. I've always had a love/hate thing going on with IDEs for PHP; I've always been intrigued by the bells and whistles of IDEs but the memory usage has always been a sore spot I can't get past. Needless to say, I invariably end up going back to EditPlus.

When I first started with PHP I used DreamWeaver 4 as my IDE tool of choice for a while, eventually switching to newer versions of DreamWeaver as they came out. Obviously,  I was a pretty crappy PHP developer at the time; there was no thought to process or cleanliness and DreamWeaver helped make sure I didn't.

Like most serious programmers do, I eventually found DreamWeaver getting in the way more than helping so I went on a bender, switching IDEs about every few months (and sometimes every week).

I've worked locally on a Linux server with Joe, Pico and Vim and worked with Zend Studio, Komodo, PHP Designer, PHP Edit but I always found the experience, across the board, to be lacking and/or painful. Linux text editors are fine and all but they just work too differently than I'm used to and the learning curve was just too high. The Windows IDEs above all had some nice features but their memory usage was always just abysmal.

The memory usage is the big one for me. There's nothing worse than trying to get something done and have your computer become unresponsive. It just fucking sucks man.

Being a web developer I can have quite a few programs open at a time and all of them are HUGE memory hogs. Photoshop (sometimes with 100MB+ PSD files open), CuteFTP, Internet Explorer, FireFox, Chrome, Safari, Outlook and EditPlus (my PHP editor of choice). On top of that I'm running Windows Vista which sucks up 750MB of RAM on a laptop with only 2GB of RAM.

With no programs running, my computer is using 850-875MB of RAM.

With all the above programs running I'm using around 1.75 to 1.90GB of RAM.

This leaves very little for anything else so EditPlus, with it's 2MB of RAM requirement, looks extremely appealing. Not to gush too much about EditPlus but out of the box it's got syntax highlighting, FTP (and SFTP) remote connectivity, extensibibility and it's very, very, fast and efficient.

The problem is that I'm doing more than php development now. I've spoken a little about my interest in Blackberry development and Java before and lately I've been a little frustrated with switching from EditPlus to Eclipse to Blackberry JDE (the Blackberry extension for Eclipse is outdated and doesn't work with Eclipse 3.5 so I use the JDE instead).

After working with Eclipse for a couple weeks I've grown pretty fond of it. For Java development it works great because I don't need any of the web development tools I need for building a website so the 250MB of memory it requires is a drop in the bucket.  Even taking into account the Blackberry development having to be done in the Blackberry JDE Eclipse is still a great choice for Java development.

But for web development, at the moment, I'm not so sure. With the exception of the memory usage the biggest issue is that I'm not sure Eclipse can connect to a remote server for php development; I'm still pretty new to Eclipse so I could be wrong. Without the ability to connect to a remote server this really hampers my ability to work on hosted sites.

Still, I'm going to be using Eclipse for PHP development for 1 month just to see if it's worth it. I know I'm going to have to change some of my process but, hopefully, the benefits of the IDE will outweigh any downside.

We'll see...

It was bound to happen. Ever since Google released Chrome there's been speculation about them releasing an operating system (OS) to compete with Microsoft. Being the cynical bastard that I am, my initial reaction was joy about the flood of hype and fan fare there was bound to be just like every time a new OS is debuted.

Then the strangest thing happened; no one seemed to care. Overall, there was  a lot of tempered, practical and, even a couple, educated articles about the "event".

Sure, a couple sites went kind of stupid, but that's bound to happen whenever there's a whiff that Microsoft needs to watch out.

Wow. So you know all those whispers about a Google desktop operating system that never seem to go away? You thought they might with the launch of Android, Google’s mobile OS. But they persisted. And for good reason, because it’s real.

In the second half of 2010, Google plans to launch the Google Chrome OS, an operating system designed from the ground up to run the Chrome web browser on netbooks. “It’s our attempt to re-think what operating systems should be,” Google writes tonight on its blog.

But let’s be clear on what this really is. This is Google dropping the mother of bombs on its chief rival, Microsoft. It even says as much in the first paragraph of its post, “However, the operating systems that browsers run on were designed in an era where there was no web.” Yeah, who do you think they mean by that?

And it’s a genius play. So many people are buying netbooks right now, but are running WIndows XP on them. Windows XP is 8 years old. It was built to run on Pentium IIIs and Pentium 4s. Google Chrome OS is built to run on both x86 architecture chips and ARM chips, like the ones increasingly found in n

Sigh...

Quite the ridiculous statement. Thankfully, there's an excellent response on The Register that takes Tech Crunch to task while making some very good points:

When Chrome was first released, journalists loved the idea that Google was taking on Microsoft, but it just wasn't so. Now that Google will be releasing an operating system, the Goliath vs. Goliath story gets a little clearer. Yes, Chrome OS will be competing with Windows in the netbook market, which is the a tiny sliver of the PC market. No, Chrome will not replace Windows in the years to come. Let's all just calm down.

TechCrunch goes on to report: "Don’t worry about those desktop apps you think you need. Office? Meh. You’ve got Zoho and Google Apps. You won’t miss Office."

Ah, yes. Corporate IT workers everywhere have to port decades of esoteric business logic codified into Excel macros to Google Spreadsheets, but the real problem is, what are they going to do after lunch? Have you ever tried to use Google Docs for any serious task? In the words of a true hacker, it's like trying to build a bookcase out of mashed potatoes. The Microsoft Office institution will not easily be overthrown by a bunch of jokers writing JavaScript.

But it's not just Office that will keep Microsoft's hold on the PC market. Can you replace Active Directory with a web app? Is there a site I can visit to connect to my office's shared printer? What do you mean World of Warcraft doesn't run in the browser? How do I play a DVD in Google Chrome?

Keep whackin' away on that Pareto Principle and let us all know how it turns out. In the meantime, I'm going to go play a few rounds of Counterstrike on my Windows-based PC, because the best that my browser can do is Tetris. I'm sure that HTML5 will bridge that gap any day now.

Indeed. It's easy to forget that the computer isn't a web browser delivery device for the majority of people. Sure, for the casual user, mom for example, the web browser is an important part of the experience but for the rest of the world it's just a single part among many.

There's been a nagging thought in the back of my head ever since I started writing WordPress plugins; the apparent lack of oversight in the WordPress plugin distribution system. I'm not trying to create hype around anything, I really do like WordPress, but I'm worried about the implications of zero oversight.

It would be trivially simple to add an algorithm to a plugin to do all sorts of nefarious things. Off the top of my head I can imagine the following:

1. Send over a blogs comment data (email addresses) to an external server.
2. Add an admin account or change existing password
3. Hell, even deleting the entire database and files

Not a happy thought is it?

Attempting such a thing from a new plugin, with zero initial interest, would be nearly impossible because of the noise from all the other plugins. I say nearly impossible because there was recently a case of a plugin, called Pushit, which sent an email containing passwords to a gmail account upon execution. I first heard about this from a post on Mental Fruition asking the question "Are your WordPress plugins safe?".

In doing some research on connecting WordPress to SMS gateways for some mobile action, I found what is either a careless remnant of testing or a malicious attempt to steal data from people using a WordPress plugin. Actually, make that carelessly malicious.

Interested in how the Pushit plugin for WordPress was working behind the scenes, I stumbled upon quite a shocker:
...

Yet towards the end of this send function, there’s a call to PHP’s mail function. It sends the following to smart.maxx@gmail.com:

• receiving number
• message sent
• username of SMS service account
• password of SMS service account
• the short number used
• the sender name/number to be displayed on the receiving mobile
• whether the SMS was sent OK

Apparently the authors of this plugin deem that this information is something that someone with the e-mail address smart.maxx@gmail.com should have about every SMS you, or your visitors, attempt to send using their plugin. Are you cool with that?

No, I'm not cool with that and I don't know anyone who would be cool with that.

Thankfully, the Pushit plugin was only downloaded around 200 times before the issue was discovered. It should be noted that the developer of the plugin swears that it was an honest mistake; the mail() call was leftover code from testing apparently. This doesn't invalidate the fear though.

No, the fear is from an existing, popular, plugin being compromised and distributed. This is the nightmare scenario.

Take wp-click-track (my most popular plugin) for example. To date, it's been downloaded a couple thousand times and it's been written up on a few sites. Were I evil, and my girlfriend says the juries still out on that , I could easily compromise quite a few sites with a simple update. Quite the scary thought isn't it?

I know it would be nearly impossible to protect WordPress from malicious code because plugins are written in php and, because of that, have access to all the resources WordPress does.  PHP can't be sandboxed so manual screening would be pretty much required.

The fact that there isn't any manual screening to date is surprising though. WordPress is owned by Automattic, which has received at least 29.9 million dollars in funding so they have money. Just look at it: $29,900,000. That's a lot of money so it's pretty tough to understand the argument, if it was used, that there just isn't money available for a person to provide manual oversight.

That is inexcusable.

I'm not saying it would be easy by any means, but if a company has 29, fucking, million dollars based on the back of a shoddy system there's no reason why they couldn't spend some money adding oversight to the plugin system.

As mentioned above, since WordPress plugins are written in raw php they have full access to all the functionality WordPress does so solving this issue programmatically would be nearly impossible. No, without using some sort of meta language, similar to Smarty, manual oversight is probably the only solution.

At the very least take 2-4 programmers, or, hell, one really talented programmer, and have them write a couple scripts to parse the plugin svn repository looking for suspicious function calls (rm(), mail(), exec(), etc) and algorithms (DROP table) and have the programmer intervene manually if anything suspicious is detected.

Heal thyself WordPress. Now.

The Linux command "top" is one of the most used and powerful jewels in a developers pocket.

In most Unix-like operating systems, the top command is a system monitor tool which produces a frequently-updated list of processes. By default, the processes are ordered by percentage of CPU usage, with only the "top" CPU consumers shown. The top command shows how much processing power and memory are being used, as well as other information about the running processes. Some versions of top allow extensive customization of the display, such as choice of columns or sorting method.

The top command is useful for system administrators, as it shows which users and processes are consuming the most system resources at any given time.

The great thing about "top" also highlights one of it's weaknesses; it's focused on CPU, memory (RAM) and time. Top is wonderful if you want to know how much performance your program is using but if you want to know how much the individual components are using you're out of luck.

Enter mtop.

mtop (MySQL top) monitors a MySQL server showing the queries which are taking the most amount of time to complete. Features include 'zooming' in on a process to show the complete query, 'explaining' the query optimizer information for a query and 'killing' queries. In addition, server performance statistics, configuration information, and tuning tips are provide

mtop is a pretty useful program; it really helps in finding out the trouble spots in queries. There one obstacle to consider before diving into though; mtop is written in PERL so there are a couple module dependancies (Curses, DBI, DBD::mysql, Getopt::Long and Net::Domain

Still, I didn't run into any issues installing the program and, so far anyway, mtop is a nice addition to my tool box.

There's always been all sorts of hype in the php community surrounding the dozens of latest and greatest frameworks sprouting up all over the place. Not that I'm cynical about the framework methodology or anything but, aside from the fun, academic, part, I didn't really see much use for of them. Over the years, I've taken a look at CakePHP, Symphony, CodeIgniter, to name a couple, but I've always found the frameworks to be a little... uninspiring.

Plus, like most developers, I've developed quite the little tool kit over the years that helps me develop applications far faster than I felt I would using a framework. I know my tool kit inside and out and I've spent a great deal of time and love making sure it's simple, deep, extensible, logical and, most of all functional. My tool kit works very well; to me, this is the killer issue.

How can the developers of all the various frameworks hope to compete for my attention when at best, I'll have to rewrite tons of code and at worst, I'll have a horrible time doing it? I have shit to do; unless the quality of my life improves, I'm out.

Well, sad to say, but I've since incorporated my tool kit into the StreetWise code base we call CAT. Not to go into too much detail, but we at StreetWise needed to make a tough choice regarding our internal application and absorbing my tool kit made the most sense. I'm actually a little honored that I could provide a solution (though this is tempered by the fact that I wrote the first version of the SW code 4 years earlier and it's become unmaintainable since).

Cool? Yes, but this leaves me with an empty toolbox.

So, I've been looking for a new start and now that I'm starting with nothing I'm all over the whole framework thing. After looking at all of the above I've finally decided on Zend Framework. I chose the Zend Framework because it's a pretty complete, component based system. I like components. I don't care so much about the MVC architecture, I like Smarty, but I can get over this.

I've only been playing with it for a couple weeks and there really are a couple bummers about it;

1. You can't use Zend Framework on IIS without a lot of pain. There's a tutorial on how to do it but it's complicated and I couldn't get it working right.
2. The whole zf.bat thing is a crock; no matter what I did I couldn't get it to work on either Windows or Linux. Weak.
3. Configuration is complicated, bothersome and awkward.

I do like that it's;

1. zf.bat is extremely useful for generating the base skeleton of your programs. Setting it up is a little painful on Windows, but as long as you avoid the tutorial from Zend, and follow this one from Akra's Devnotes, you'll be fine.
2. As said above, the Zend Framework is component based. I love that there's a whole library of code available to be exploited and used. Reminds me of what I loved about my tool kit.
3. Object oriented. I'm ready to accept that OOP is a good thing; the limitations of functions and includes is pretty obvious at this point.
4. The Zend Framework Manual; this is an awesome resource. Every class in the Zend Framework is documented in the manual.

I'm excited. I've already got a couple personal projects in the works using the Zend Framework and I'm sure there'll be more posts discussing it.

Here's another random MySQL issue I run up against from time to time; an obscure duplicate key error.

#1062 - Duplicate entry '2147483647' for key 1

The reason for the issue is because the script is trying to use an INT column type with a number larger than 2147483647 and 2147483647 is the highest number you can have on a 32bit system.

The number 2,147,483,647 is also the maximum value for a 32-bit signed integer in computing. It is therefore the maximum value for variables declared as int in many programming languages running on popular CPUs, and the maximum possible score for many video games. The appearance of the number often reflects an error, overflow condition, or missing value.

The data type time_t, used on operating systems such as Unix, is a 32-bit signed integer counting the number of seconds since the start of the Unix epoch (midnight UTC of January 1, 1970). The latest time that can be represented this way is 03:14:07 UTC on Tuesday, 19 January 2038 (corresponding to 2,147,483,647 seconds since the start of the epoch), so that systems using a 32-bit time_t type are susceptible to the Year 2038 problem.

Online microblogging service Twitter faced a similar problem (called a "Twitpocalypse") at 2009-06-12 23:52:04 GMT, when the unique identifier associated with each tweet exceeded 2,147,483,647. While Twitter itself was not affected, some third-party clients were, and had to be patched.

Ironically, the issue that precipitated this post was for a Twitter app. A little advise; if you're storing twitter post ids don't use INT for the column type

It's a pretty common error actually; definitely not one to be too embarrassed about (you should be a little embarrassed though). In fact, if you've ever played a video game you've probably already seen it.

A number which is commonly found in hacked games and the score will be 2147483647. It is also the highest score you can get in a 32 bit game. The maximum score is 2147483647 because most games are written in 32 bit and it has to represent both negative and positive integers so 2^31 - 1 would be 2147483647. It is also commonly known as Mersenne Prime which a prime number that is one less power of two.
1. h4x0r - 2147483647
2. h4x0r - 2147483647
3. h4x0r - 2147483647
...

noob: OMG... someone has hacked the game and got 2147483647
h4x0r: beat that score noob

Perhaps the coolest effect, or scariest if you're a pussy, issue with 2147483647 is, as shown above, what's being called the Year 2038 problem.

The Year 2000 problem is understood by most people these days because of the large amount of media attention it received.

Most programs written in the C programming language are relatively immune to the Y2K problem, but suffer instead from the Year 2038 problem. This problem arises because most C programs use a library of routines called the standard time library . This library establishes a standard 4-byte format for the storage of time values, and also provides a number of functions for converting, displaying and calculating time values.

The standard 4-byte format assumes that the beginning of time is January 1, 1970, at 12:00:00 a.m. This value is 0. Any time/date value is expressed as the number of seconds following that zero value. So the value 919642718 is 919,642,718 seconds past 12:00:00 a.m. on January 1, 1970, which is Sunday, February 21, 1999, at 16:18:38 Pacific time (U.S.). This is a convenient format because if you subtract any two values, what you get is a number of seconds that is the time difference between them. Then you can use other functions in the library to determine how many minutes/hours/days/months/years have passed between the two times.

All this from one number.