First, I'm going to point out that I do love symfony - I'm mostly happy with it, and I'm a active member of the community. I certainly appreciate the effort put in by Fabien and everyone else who's worked on the symfony project - it's a fantastic achievement. However, there's a couple of things which really wind me up, and I'm concerned things aren't going to change.

One thing that's been pointed out several times in the past is that the symfony website is very unreliable. I personally found the hosting so unstable I setup a SVN mirror - and there's been requests for an offical symfony mirror. This request however went unanswered. Does it matter if the symfony site goes down? Personally I think it matters, both for Sensio and for symfony. If Sensio can't keep the symfony site itself running, doesn't that set a bad image for the project? It also sets a really bad image for Sensio themselves - if they can't maintain a site's uptime - would you want to use them for consultancy for your own projects?

My other main concern is the way security is handled. Today I noticed that Ticket #1617 had been closed in SVN logs. This security issue has been open for a year! Also, I reported this issue over 2 years ago. There was no 'official' security advisory made about this - nor other issues that have occurred.

In my opinion, mentioning these security issues just in the revision log, or the blog is not enough. There should be mails to the dev/user list - and a security procedure in place to handle issues. In the past someone has come onto IRC and was concerned that a security issue they reported about bypassing validation using different HTTP verbs via email to Fabien personally was being ignored. I'm sure Fabien is a busy man, but the symfony website needs to have how these things are handled documented. I can't remember the outcome of this issue, and google didn't tell me much - maybe it was a non-issue, but if it wasn't - no security advisory was released.

Other security issues have been discussed, such as the security of _dev.php files, and the default permissions. These issues haven't really been addressed in my opinion - and both are what I would consider critical issues.

I accept that symfony is an open source project, and that we could fix these issues amongst the community - but I feel Sensio have an important role to place in this. Sensio understandably keep a very tight grip on the project, but in doing so they take on certain responsibilities. I would like to see more active discussion of security related issues on the dev list - with more involved responses from Sensio. I'd like to see an announce mailing list where security and release information is published. I'd like to see current security issues highlighted and made VERY clear on the main website.

I'd like a security reporting system documented and clearly linked from the ticketing system, so there's a clear channel to report security concerns, knowing they will be dealt with.

I can never remember how to output to a CSV file from postgres, and end up having to google it time and time again - so I'm making a note of it here mostly for my own use

\f ','
\a
\t
\o /tmp/moocow.csv
SELECT foo,bar FROM whatever;
\o
\q

If a field has newlines, this will break. You can do something like this instead.....

 SELECT foo, bar, '"' || REPLACE(REPLACE(field_with_newilne, '\n', '\\n'), '"', '""') || '"' FROM whatever;

The Dell PERC/5 shows like this under 'lspci'

07:08.0 SCSI storage controller: LSI Logic / Symbios Logic SAS1068 PCI-X Fusion-MPT SAS (rev 01)
        Subsystem: Dell SAS 5/iR Adapter RAID Controller

The status of this RAID card can be read using mpt-status, in Gentoo this package is available as sys-block/mpt-status. Here's an example of the output:

# mpt-status
ioc0 vol_id 0 type IM, 2 phy, 148 GB, state OPTIMAL, flags ENABLED
ioc0 phy 1 scsi_id 32 ATA      WDC WD1600JS-75N 2E04, 149 GB, state ONLINE, flags NONE
ioc0 phy 0 scsi_id 1 ATA      WDC WD1600JS-75N 2E04, 149 GB, state ONLINE, flags NONE

The latest 'check_mpt' script can be found on Nagios Exchange. Download it and put it in your libexec folder, for me on gentoo its '/usr/nagios/libexec/'. Open the file, and make sure the 'use lib' line points to the correct place.

The script uses sudo to run mpt-status, so you'll need to modify your /etc/sudoers - adding a line like this:

%nagios ALL=(ALL) NOPASSWD:/usr/sbin/mpt-status

Next, you need to configure nagios, your filenames might be different from the names I use below.

/etc/nagios/commands.cfg : Note, the -c param refers to the number of disks you expect to be active.

define command{
  command_name  check_mpt
  command_line  $USER1$/check_mpt -c 2
}

/etc/nagios/localhost.cfg

define service{
  use                  local-service
  host_name            localhost
  service_description  mpt - Dell Raid
  check_command        check_mpt
}

Reload nagios, on gentoo, it's /etc/init.d/nagios reload

Nagios can be pretty, and several people I've told this too seemed surprised, so I thought I'd put a quick note here. Here is a nice theme for nagios....

http://new.nagiosexchange.org/cgi-bin/page.cgi?g=Detailed%2F1723.html;d=1

Unfortunately, the underlying UI is still the same horrible interface, but.... this does make a big difference to the aesthetics

I've had a Forerunner 305 for a while now. On the rare occasion I go running, I find it really useful. At first, I thought t would be a great geeky toy that I'd get bored of - I honestly expected it would find its way into a draw and never be used again after the first couple of uses.

However, it's actually a great running accessory, and I advise this kinda hardware to all by the most casual of joggers. It's far too easy to run too fast when you're out running - you can set the forerunner up to beep at you when you go too fast or too slow - obviously you configure these speeds yourself. Recently I ran a half marathon, I did virtually no training for it, and without the forerunner on my wrist making sure I didn't run too fast or too slow, I'm not sure I'd have finished!

A few pointers for people trying to get Dell's PERC 6/i RAID monitoring working under Ubuntu, and any other linux for that matter. It also applies to PERC 5/i too, and... other stuff

First, visit Dells Linux site. Have a poke about, see what's there.

Next, we need to download a tool to get information from your array. Download LSI's MegaRAID CLI tool for linux. It comes as a .RPM, so if you're an ubuntu user, you can convert it to a .deb using alien, or convert it to a .tar.gz.

You then have a CLI tool you can use to get all your data now! For example:

One thing I spent a while figuring out was how to get the rebuild progress, so here's how:

There's also a really useful cheat sheet for common tasks

Don't forget to actually monitor this output with nagios, or your favorite monitoring tool!

A you might has been in my previous post there's quite a discussion about how a lot of PHP frameworks break MVC.

I stayed clear of commenting, as I didn't want to get drawn in, however one comment did ask what I thought, so here it is!

As you'll know from my previous post, I was 'heckled' during the Q&A of the framework talk I did. This wasn't aimed at me, but rather at all 3 of us on the panel, and more importantly, at 'MVC' frameworks as we commonly see them today. Marcus Boniton also mentions this incident on his blog.

Personally, I don't think he's a crazy guy, I just like the title and find it quite amusing

I pointed the 'crazy guy' to my previous blog entry, where he replied to an author of one of the comments, and CCed me in. I thought it was a very interesting mail, so it's included below. I put this here with full permissions from Mike.

I talked at PHPLondon Conference 08 yesterday. I'm putting my slides online, here they are!

My phplondon08 symfony Presentation

I got slightly heckled, and was amazingly nervous because it was my first time talking, but I think it went well! Apparently the audio recordings will be available at some point, I'll update this post when they are.

I'm calling this part 1, because I hope to follow it up at some point, although... who knows!

I wanted to be able to upload my photos from my N95 directly to my website, and notice that S60 phones appear to have an option to upload to Flickr and Vox using the 'online services' system, so I figured adding my own shouldn't be too hard. After a bit of googling, I found this:

lifeblog_posting_protocol_specification_1.0.pdf

It's pretty common for sites to have a password reset system on websites, which allow you to enter your email address, and have the site email you a link you can use to reset your password.

I had a specification that demanded this kind of system, however it needed to be stateless - in that I could not store any extra information. Also, the hash could only be used once, and it was required that it needed to time out after a configurable time period. Also, the URL must be short enough such that it can be easily copied and pasted into the address bar from an email, and doesn't wrap in the email.

I got PHP4, compiled it as CGI.. here's how.

Install required packages

  apt-get install make libmysqlclient15-dev libmcrypt-dev libxpm-dev libpng12-dev \
libjpeg62-dev libcurl4-openssl-dev apache2-dev  gcc bison flex

configured as follows.

./configure --enable-force-cgi-redirect --disable-cli --enable-discard-path  \
 '--prefix=/home/pookey/php/' '--with-xml'  '--enable-bcmath' '--enable-calendar' \
 '--with-curl' '--enable-ftp' '--with-gd' '--with-jpeg-dir=/usr' '--with-png-dir=/usr' \
  '--with-xpm-dir=/usr/X11R6' '--with-mcrypt' '--enable-magic-quotes' \
 '--with-mysqli' '--with-mysql=/usr' '--with-openssl' \
  '--enable-discard-path' '--with-pear' '--enable-sockets' \
 '--enable-track-vars' '--enable-versioning' '--with-zlib'

This installed it into /home/pookey/php

Enabled per vhost using the following syntax

  SetEnv PHPRC /home/pookey/php/lib/stage
  ScriptAlias /php4-cgi /home/pookey/php/bin/php

  <Location />
    Action php4-script /php4-cgi
    AddHandler php4-script .php
  </Location>

For some stupid reason I failed to figure out, doc_root needs to be set to the document root for each vhost, and can only be done in php.ini (setting PHP_DOCUMENTATION_ROOT with SetEnv failed). This means each vhost needs it's own php.ini, which is placed wherever you set PHPRC to.

Using this system, you can have PHP4 and PHP5 mixed even on the same vhost

I noticed that google was going crazy indexing trac for doctrine. Today it downloaded over 90000 pages, transfering 3 gig of data! It was causing quite a bit of load on the server (not huge amounts, but enough to show in my graphs!)

Eventaully , I came up with a nice little trick for reducing the number of hits google will make against a trac install. Google have extended robots.txt to allow some slightly improved pattern matching. Here's my snippet, if you don't understand it, please don't use it.

User-Agent: Googlebot
Disallow: /*?rev*

Took me a while to figure this out, so thought I'd put it here for others. This is useful for Xen setups, where you use a file for the disk image. AFAIK, you can only grow an image, not shrink it.

# dd if=/dev/zero bs=1M count=1024 >> disk.img
# e2fsck -f disk.img
# resize2fs disk.img
# e2fsck -f disk.img

This makes the disk image bigger, checks the image, resizes the file system, and then checks it again

Check out this blog post. Looks promising, PHP might finally get name spaces, and somehow, they have managed to use the '::' separator! Great news, but I'm not going to believe it till I see it released, even though it's been checked into SVN already