Johan Louwers - Tech blog: November 2006

Wednesday, November 29, 2006

The Early Days of PHP

The following article was originally published on the Oracle website and was originally done by Rasmus Lerdorf. Oracle published a number of articles about PHP to promote the language in combination with the Oracle database. A number of articles about PHP and Oracle can also be found on terminalcult.org

PHP's creator offers his thoughts on the PHP phenomenon, what has shaped and motivated the language, and where the PHP movement is heading

PHP is everywhere. In its February 2004 Web server survey, Netcraft poked 47,173,415 domains and found that 15,205,474 had PHP installed. That is approximately 32 percent of all domains on the Web, and there is no sign of its slowing down.

The Early Days of PHP

I started developing PHP nearly 10 years ago now. That was long before the term "Open Source" was coined and before the GPL and Free Software was well known. And as with many open source projects that have gone on to become popular, the motivation was never philosophical or even narcissistic. It was purely a case of needing a tool to solve real-world Web-related problems. In 1994 the options were fairly limited when it came to Web development tools. I found myself writing dynamic components for Web sites in C or Perl, and the code overlap from one problem to the next was quite significant. For performance reasons, I was increasingly tending away from Perl and toward C, because the fork+exec overhead of having to run Perl as a standalone CGI was too restrictive.

The initial unreleased version of PHP was mostly a C library of common C functions I had written to be easily reusable from one open source project to the next. I had a simple state-machine-driven parser that picked tags out of HTML files and called the back-end C functions I had written. This code was initially released to the public as a package called Personal Home Page Tools, and each tool in the package was an example of how to use the system to solve a common problem on a personal home page. At some point along the way, I split out a piece and called it FI, for Form Interpreter. The idea behind FI was that it could do all the common things you needed to do when you received the result of a form submit. Some early examples:

[01] 
[02] 
[03] Hey, you are using Netscape!<p>
[04] 
[05]
[06] 
[07]
[08] 
[09] Sorry, that record does not exist<p>
[10] 
[11]
[12] Welcome !
[13] You have  credits left in your account.<p>
[14]
[15] 

My parser for FI was terrible, which prompted me to try to write a better one. I moved away from the syntax and went to instead, recombined parts of the Personal Home Page Tools with this new FI tool, and released that as a package called PHP/FI (the name was a bit of a tongue-in-cheek play on TCP/IP) in late 1995. PHP/FI grew right along with the Web over the next couple of years. In 1997 two guys in Israel, Zeev Suraski and Andi Gutmans, who were using PHP/FI asked if I would be interested in using a new parsing engine that they would write for the next version of PHP. I gathered up a few other people who had been sending patches and code for PHP/FI and we all coordinated to release PHP version 3 in mid-1998. This was probably the most crucial moment during the development of PHP. The project would have died at that point if it had remained a one-man effort and it could easily have died if the newly assembled group of strangers could figure out how to work together towards a common goal. We somehow managed to juggle our egos and other personal events and the project grew. The number of contributors has grown steadily and today we are pushing towards a release of PHP 5.0 sometime in the first half of 2004.

The Ugly Duckling of Programming Languages

Popular opinion about PHP is polarized. Language purists tend not to like the somewhat haphazard implementation of many features and some of the inconsistencies that have emerged over the years. At the same time, pragmatic problem solvers tend to love how PHP seems to almost read your mind and present itself as the perfect Web problem solving tool.

Among the things that drive the purists crazy are that names of functions are not case-sensitive but variables are; built-in functions are not consistently named; and no real structure is enforced on PHP developers, making it easy to write messy code. I can't really argue with these criticisms, but I can at least attempt to explain how and why we got to this state.

First, regarding the function-name case-sensitivity issue: This goes back to the very first version of PHP. In the early days of the Web, long before XHTML, it was very common for all HTML markup tags to be uppercase. But because these tags were not case-sensitive, people weren't very consistent about this. I wanted people to treat the special PHP tags as being basically just like other markup tags, which meant that PHP's tags should also not be case-sensitive. As PHP became more advanced and received features such as variables, it didn't hurt to make these new features case-sensitive, because it didn't break backward compatibility with existing PHP pages. Going back and suddenly making the initial simple tags, which were in essence just function calls, case-sensitive would have broken those pages and made them unusable in newer versions of PHP. People shouldn't have functions whose names differ only in case, anyway. Still, in retrospect, it would have been a good idea to break backward compatibility early on, when relatively few people were using PHP, but at the time, nobody could have predicted the amazing growth of PHP.

As to function naming itself, I tended to steal/borrow ideas from other languages and APIs I was familiar with. This means that PHP has functions such as strlen( and substr(), which would look silly if written as str_len() or sub_str(). I added things like stripslashes(), which, because of the length, is often written as StripSlashes() to make it easier to read. At the same time, I mimicked low-level database APIs, with functions such as msql_connect()—miniSQL was the first database to be supported by PHP—which used underscore naming. People familiar with these various sources were quite at home with the naming in PHP. PHP was never so much a standalone language as it was an interface between the Web server and all the various back-end tools you wanted to hook into the Web server. Consequently, when people look at PHP today as a standalone language without taking its context into account, it can appear somewhat inconsistent.

About the lack of enforced structure, all I can say is that I absolutely hate programming frameworks that lock me into a certain way of approaching a problem. That doesn't mean I don't believe in structure and frameworks, but I do believe in people having the power to come up with their own to match their environment. More on this later in the article, when I discuss possible architectures for your various PHP projects.

What it all boils down to is that PHP was never meant to win any beauty contests. It wasn't designed to introduce any new revolutionary programming paradigms. It was designed to solve a single problem: the Web problem. That problem can get quite ugly, and sometimes you need an ugly tool to solve your ugly problem. Although a pretty tool may, in fact, be able to solve the problem as well, chances are that an ugly PHP solution can be implemented much quicker and with many fewer resources. That generally sums up PHP's stubborn function-over-form approach throughout the years.

Advice for Architects

The most popular deployment model for PHP is for it to be linked directly into the preforking multiprocess Apache 1.3.x Web server. Unlike with Java, there is no standalone process like the JVM. PHP is similar to scripting languages such as Perl and Python in that it parses and executes scripts directly.

The lack of a central control process is a feature and at the same time a source of great frustration for many. The shared-nothing architecture of PHP where each request is completely distinct and separate from any other request leads to infinite horizontal scalability in the language itself. PHP encourages you to push scalability issues to the layers that require it. If you need a shared datastore, use a database that supports replication and can scale to the levels you need. If you need to load balance requests or distribute certain requests to certain servers, use a front end load balancer that supports this. By avoiding a central controlling process, PHP avoids being the bottleneck in the system. This is the defining characteristic that separates PHP from what people commonly refer to as application servers.

In the diagram above, one or more load balancers distribute incoming requests across any number of Web servers. For data storage, you might deploy a read-only database replica on each Web server if your dataset is small enough to let you do that, or you might create a separate tree of database servers to handle various types of requests.

Adding Structure

One of the big strengths of PHP over many other tools aimed at solving the Web problem is that other tools tend to associate such very specific targeted problem solving with the need to control how users approach the problem structurally. PHP doesn't impose any such structure, choosing instead to focus on making each individual functionality aspect of the problem as easy as possible to use. For example, PHP provides very targeted functions for communicating with a back-end database. These are specific to each database and do not sacrifice any performance to gain uniformity or consistency with other back-end databases. There is also no set way to structure a PHP application in terms of file layout and what goes where.

The fact that PHP doesn't impose structure doesn't mean that you shouldn't build your PHP applications in an organized and structured way. Here is one approach I like to show people who ask me how I would go about structuring a large PHP application.

+--------------------------------+
| HTML TEMPLATES |
| $DOC_ROOT/*.php |
+--------------------------------+
| TEMPLATE HELPERS |
| $DOC_ROOT/*.inc |
+--------------------------------+
| BUSINESS LOGIC |
| /usr/local/php/*.inc |
+--------------------------------+
| C/C++ CORE CODE |
| /usr/local/lib/php/*.so |
+--------------------------------+

This four-layer approach addresses a couple of issues. First, it separates the content along the lines of responsibility in a typical project. The Web front-end developers work from the top, and the back-end engineers work from the bottom. They overlap a bit in the template helpers layer. It also separates anything that contains HTML, by putting those files into the document_root and anything that doesn't contain HTML outside the document_root.

The top template layer typically contains very little PHP—just simple function calls and the odd include. Perhaps a loop. These files are usually edited with an HTML authoring tool. The second layer, the template helpers, is where the interface between the business logic and the layout is defined. This layer might have convenience functions such as start_table(), show_user_record(), and any other reusable component that makes template authors' lives easier.

The business-logic layer does not contain any HTML at all. This is where such things as SQL queries and any other PHP user-space business logic is implemented. You might expect to see a function such as get_user_record() implemented in this layer. This function would take an ID, perform the appropriate SQL query, and then return an associative array with the result. A function in the layer above then takes this array and wraps some HTML around it to make it look nice.

The final C/C++ layer is where you put any custom back-end code required for a project. Many people will not have anything for this layer, but if you have a proprietary C or C++ library, you can write a PHP extension to interface to that here. Sometimes this layer is also used when a business-logic function written in user-space PHP turns out to be too slow.

Hiring and Training PHP Developers

PHP is not a new language. It doesn't introduce any new concepts. This means that training programmers who already know any C, C++, Perl, or even Java to write PHP code is quite easy. I tend to look for people with C or C++ skills when I go looking for PHP developers for a project, the thinking being that you are much better off hiring experienced programmers than you would be if you hired someone who necessarily knows a lot about PHP. If they can handle those languages, PHP will be trivial for them. Of course, if they have experience with both, so much the better.

Deploying PHP Everywhere

Use the right tool for the job. I have run across companies that have completely bought into PHP, deploying it absolutely everywhere, but it was never meant to be a general-purpose language appropriate for every problem. It is most at home as the front-end scripting language for the Web. Depending on the traffic the Web site gets, it can be used to do the bulk of the back-end work as well. But at a certain point, you are going to need to write part of your code in a strongly typed, compiled language such as C or C++ for optimal performance.

Where Is PHP Going?

People are always asking me what lies ahead for PHP. That is a very difficult question to answer, because PHP is mostly a reactive open source project, in that it evolves to meet the needs of its community. In PHP5, the OO capabilities and integration with XML have been improved greatly. We have integrated an interesting tool called SQL-Lite, which provides a SQL interface directly to a file without requiring a server. It is not a replacement for a real database, obviously, but using it is certainly a much better approach than trying to write your own flat-file manipulation routines. And the fact that it gives you a SQL interface means that migration to a real database becomes easier if that is ever required.

These changes in PHP5, although significant, are evolutionary. We are not turning the world of PHP upside down with this release. Of the scripts written for PHP4, 99 percent will work unchanged in PHP5. The biggest change is that objects are handled differently in PHP5. When you new an object in PHP5, you now, by default, get a reference to that object that you can pass around without explicitly stating that you want the object passed by reference, as you had to in PHP4. If you actually want a copy of the object in PHP5, you need to "clone" it.

Longer-term, there are people exploring the use of the Parrot engine. Parrot was written as the engine behind Perl6, but it is really a language-neutral general-purpose scripting engine. It would be very interesting if the various scripting languages could all agree on a single back-end engine, which could then be used as a basis for common extensions and much better language interaction.

And still others are exploring Java connectivity through JSR 223, with some thinking that Java can be the single universal back end for scripting languages.

Despite what the future may hold for PHP, one thing will remain constant. We will continue to fight the complexity to which so many people seem to be addicted. The most complex solution is rarely the right one. Our single-minded direct approach to solving the Web problem is what has set PHP apart from the start, and while other solutions around us seem to get bigger and more complex, we are striving to simplify and streamline PHP and its approach to solving the Web problem.

Rasmus Lerdorf (rasmus@lerdorf.com) was born in Godhavn/Qeqertarsuaq on Disko Island off the coast of Greenland in 1968. He has been dabbling with UNIX-based solutions since 1985. Known for having gotten the PHP project off the ground in 1995, the mod_info Apache module and he can be blamed for the ANSI92 SQL-defying LIMIT clause in mSQL 1.x which has now, at least conceptually, crept into both MySQL and PostgreSQL.

He tends to deny being a programmer, preferring to be seen as a techy adept at solving problems. If the solution requires a bit of coding and he can't trick somebody else into writing the code, he will (very) reluctantly give in and write it. He is currently an infrastructure engineer at Yahoo! Inc. in Sunnyvale, California.

Tuesday, November 28, 2006

Oracle iStore security vulnerability

Some time ago I published a paper on my website about a bug in Oracle Store. Now I like to repost it on my weblog also. The bug is a combination of bad coding from the side of Oracle and not applied security settings. When the bug is exploited a user is able to view all the orders ever placed in an oracle iStore installation.

For those who are not aquatinted with Oracle iStore, iStore is the Oracle webshop application.

Preface:
Current versions of Oracle iStore have a known bug, which enables users to view orders in order tracker placed by other customers. The root cause is bad coding from Oracle. When a order is queried from the Oracle iStore order tracker the only reference key is the order number.

Reproducing the problem:
Login to Oracle iStore and go to the order tracker page [/ibeCOtdOrdSumMain.jsp?a=b]. This page will give you an overview containing all the orders placed by this customer. When selecting one of the orders the number parameters will change and [ibeCOtdOrdSumMain.jsp] will contain the following parameters and possibly the following values depending on your implementation: ?qsr=0&qob=5&qia=false&qc0=13&qo0=AIS&qv0=4077&qa=details&qid=

If qid contains a long string of alphanumeric characters you have encryption enabled however if it contains a numeric string your iStore implementation is vulnerable of URL manipulation.

If qid contains a numeric string you can shift between orders by changing the number. This will enable the user to view ALL orders available in IBE_ORDER_HEADER_V.

Root cause:
When a order detail page is queried iStore is executing the following query where the value of qid relates to the column HEADER_ID in IBE_ORDER_HEADER_V. This is the only binding value between the record and the user request. There is no validation done to determine if the order is placed by the same customer as the one requesting the details of the order.

Quick fix:
Preventing the user from manipulating the URL is to enable encryption to encrypt the parameter values used in the URL. This is a standard functionality. To enable the encryption take the following steps:

(1) Login to Oracle e-business suite using the sysadmin account.
(2) Go to Setings - System - Cookies.
(3) Make sure there is a value entered in the [Encryption Key] field. If not enter a random encryption key.
(4) Reboot and check if the URL parameters are encrypted. Please note NOT ALL parameters will be encrypted.

NOTE:
It is possible that you have done some customizations to Oracle iStore which will cause errors after enabling encryption. The reason for this is that you probably do not a decrypt function for some of the parameters which are now encrypted. This results in iStore trying to use the encrypted strings as a value instead of using the real decrypted value. (Example: instead of using the values 5 it is now using the value G57FHSYEGE3H2J83GA8E3K3H37)

If this is the case you will have to add decryption and encryption routines into your code to make it work with the new encryption. The best way to do this is to catch this in a if statement which enables you to create code that will encrypt and decrypt only if the encryption option is turned on. This will prevent you from having to change code again if you ever have to turn encryption off again.

Please find an example of this below:
//If encryption is active encrypt URL parameter.
String retrieveKey = SiteProperty.getValue("cookie_encryption_key");
IBEUtil.log("ibeCOtdOrdSumMain.jsp","retrieve Key = "+retrieveKey);
if (retrieveKey != null)
{
pageContext.setAttribute("retrieveKey",retrieveKey,PageContext.REQUEST_SCOPE);
}
String key = (String)pageContext.getAttribute("retrieveKey",PageContext.REQUEST_SCOPE);
String xxEncOrder_number = cartIdStr;
if (key != null && cartIdStr != null )
{
AolSecurity security = new AolSecurity();
xxEncOrder_number = security.encrypt(key, cartIdStr,cartIdStr.length());
}

Stable fix:
To fix this in a stable way you will have to change a little more. The enabling of the encryption is a good thing, and advertised and promoted by Oracle in their implementation guide. However a better fix is to change the query and the way the query is called. The best way is to add a check on customer ID to make sure that the customer requesting the details of the order is the same customer who placed the order.

Wednesday, November 22, 2006

TALON robots

A couple of days ago I reported on sentinella, a armed robot made by Samsung(). I told in that story that this was the/one of the first robots that whould be armed and therfor was in violation with the rules of robotics which are set by Isaac Asimov.

After some more research I learned that there are a lot more robots that are violating this set of rules. A good example is the Foster-Miller company which has a line of armed robots named TALON robots

TALON robots can be configured with M240 or M249() machine guns or Barrett 50-caliber rifles for armed reconnaissance missions. A prototype system was delivered to the 3/2 Stryker brigade for evaluation, and successful testing was performed by the brigade in Kuwait in December 2003. Additional prototypes have been manufactured and are currently undergoing system safety certification by the U.S. Army. Alternative weapons, including 40 mm grenade launchers and anti-tank rocket launchers, continue to be evaluated by the U.S. Army.

Tuesday, November 21, 2006

ITER, nuclear fusion

Today China, the European Union, India, Japan, Russia, the United States and South Korea have signed the an agreement for the development of a international experimental thermonuclear reactor. The project named ITER will be constructed in Cadarache, southern France, and will start in 2008, the planned cost are around 10 billion Euros. Negotiations started in 1996 and are finished as from today.

ITER will do research on nuclear fusion and a way to make this available outside a research environment. You can see the scale of the reactor if you click on the image, the man at the bottom of the reactor indicates it total size.

Even do the project is quite ambitious the ITER project will not be the first to successfully build a nuclear fusion reactor, today Thiago Olson, a 17 old student reported that he build a reactor in the basement of his parents and scientists have found his reports true.

Ulysses embarks on third set of polar passes

Ulysses is a joint ESA/NASA mission studying the interplanetary medium and solar wind in the inner heliosphere, beyond the Sun's equator, for the first time.

The heliosphere is the immense magnetic bubble containing our solar system, solar wind, and the entire solar magnetic field. It extends well beyond the orbit of Pluto. While the density of particles in the heliosphere is very low (it's a much better vacuum than is created in a laboratory), it is full of particles of interest to heliospheric scientists.

The spacecraft's high-inclination orbit around the Sun took it over the solar south pole in 1994 and then the north pole in 1995. Ulysses then made a second southern solar pass above 70 deg latitude during September 2000 to January 2001, and a similar northern pass during September to December 2001. On 17 November 2006, the spacecraft started its third passage over the Sun's south pole.

Ulysses' high-gain antenna points continuously towards Earth, returning data for 8 h every day as it investigates the Sun's domain.

Monday, November 20, 2006

PHP for the Enterprise

Dynamic scripting for agile application development
PHP, the open source general-purpose scripting language often used for Web development, is a popular student on campus—especially corporate campuses. According to independent research firm Netcraft, PHP is used by more than 40 percent of the Web applications market, and more than 22 million Web sites have been built with it. So what's behind this growing popularity? Let's take a closer look, starting with PHP's beginnings.

Danish computer scientist Rasmus Lerdorf created Personal Home Page/Forms Interpreter (PHP/FI), a set of Perl scripts to track access of his online résumé, in 1995. PHP/FI had some of the basic functionality of today's PHP, including Perl-like variables, automatic form variable interpretation, and HTML-embedded syntax similar to Perl's, but it was simpler and less powerful. A later, larger C implementation of PHP Tools could communicate with databases.

"Today PHP is a recursive acronym for PHP Hypertext Processor," explains Richard Rendell, product development director at Oracle. "It's come a long way in the past decade and is a powerful language for server-side scripting. PHP is a viable alternative to ASP [Active Server Pages] and JSP [JavaServer Pages]."

Rendell adds that before PHP, Web scripting was done mostly in Perl. "For a novice, Perl has a very challenging syntax and can be obtuse," says Rendell. "Perl is a powerful language, but it's not easy for people to learn—it wasn't written from the ground up to work with the internet. The internet needed a simple and highly productive scripting language, and that's where PHP came in."

Putting PHP to Work
Most developers today use PHP in Web applications from the simplest guest book or blog to shopping carts, content management systems, and other complex applications. PHP scripts are used for server-side scripting, command-line scripting, and desktop applications. With PHP server-side scripting, developers can do almost anything—generate dynamic page content, collect forms data, handle cookies—and more.

"As the PHP language has matured, its power has evolved. You can do more things with it, and we've started to see the beginning of enterprise PHP applications. These include CRM products such as SugarCRM; collaboration suites such as eGroupWare; and content management systems such as Mambo, PostNuke, and many others," says Rendell. "We're seeing PHP in an enormous number of areas, because anything you can do on the internet you can do in PHP. It's used to deliver most of the front-end, browser-centric applications on the Web today."

PHP runs on most operating systems, including Linux, UNIX, Microsoft Windows, Mac OS X, and others, and it supports most Web servers, including Apache, Zeus Web Server, lighttpd, and Microsoft Internet Information Server. In addition to HTML, PHP can output images, Adobe Acrobat files, Macromedia Flash, XML, and more—all of which can be autogenerated. There are many PHP extension libraries that perform common functions, and there are communities that support PHP libraries, including the PHP Extension and Application Repository, which provides, maintains, and distributes a structured library of common function and other code, and the PHP Extension Community Library, which offers C extensions that expand PHP's core functionality.

"The dynamically-typed-language approach PHP offers is gaining momentum for agile development," adds Rendell. "PHP is ideal for getting Web sites up and running very quickly and is now extending into complex Web applications."

For example, Rendell cites the million lines of PHP code running against an Oracle database at Trader Electronic Media, which operates AutoMart.com, the internet's largest dealer-only automotive Web site. AutoMart.com uses PHP and Oracle to deploy this high-volume site—a scalable, secure, open source Web site that posts more than half a million ads and manages more than 2.5 million visitors each month.

PHP, Java, and Ajax
PHP's streamlined functionality is essential for organizations with limited development resources and intense deadline pressure. With PHP even nondevelopers can be productive in days, and developers with experience in C, C++, or Java can be productive in hours.

"Often there's a great amount of engineering that goes into building a Java application when a simpler PHP Web application might suffice," says Rendell. "The J2EE framework, for example, is something the PHP community tends to hold up as a fairly complex entity."

PHP's basic tenet, explains Rendell, is to be fast and easy to use, so developers can be very productive very quickly. This agile approach lends itself to the front end of more-complex Java applications. "JSP is just one language that accesses Java objects. PHP also integrates with Java, so it can be used as the scripting language for activating Java logic, just like JSP," explains Rendell. "We're seeing an increased amount of integration between PHP and Java, where a Java application is running on the back end and PHP is running on the front end."

Ajax (Asynchronous JavaScript and XML) is a development technique that combines JavaScript, XML, and other technologies to create interactive Web applications. The combined Ajax technologies add functionality to the front-end development of Web applications.

"Ajax is a browser-centric solution in which JavaScript is used with XML to prevent the browser from having to refresh the entire page when data changes, such as at the database or when pieces on the page need to be refreshed," says Rendell. "You can use Ajax on the front end with Java, or you can use Ajax similarly with PHP. There are already frameworks for PHP that enable you to use and incorporate Ajax."

Zend Core for Oracle Database
Not long ago, installing PHP with Oracle was a time-consuming process. Developers had to download a variety of components—PHP, Apache, Linux, and the Oracle extension for PHP—install an Oracle client, and configure everything, which often led to integration issues.

To address the challenges facing developers who need to build their own multicomponent stack, Oracle offers Zend Core for Oracle, a free, integrated tool designed to help developers build and deploy database-driven PHP-based applications for Oracle. A fully tested and supported PHP 5 distribution, Zend Core for Oracle includes tight integration with Oracle Database 10g client libraries. It also contains a refactored OCI8 driver with substantial code improvements and new connection controls.

"Zend Core for Oracle is a prebuilt binary of all those technologies," says Rendell. "For example, on Linux we have all of the Linux parts of the stack, including PHP and the Oracle Instant Client, built into a single distribution configured on the platform through a basic Web browser interface. You're up and running in minutes."

PHP 5, PHP 6, and Beyond
"The overall direction for PHP as it matures is to make its way into more enterprise-level applications as organizations take advantage of the agility and ease of learning that PHP affords," says Rendell. "With PHP 5, development organizations are able to create more-powerful applications in much less time, which reduces costs."

PHP 5 includes features to address enterprise needs, including an updated Zend engine, extended XML, Web services, and enhanced database support. The engine, a core component that powers PHP, includes more than a dozen object-oriented development features that allow organizations to create maintainable component-based enterprise applications. XML support includes general XML extensions written to use the Gnome Project's XML and XSLT libraries. A new SimpleXML feature enables developers to manipulate XML files as if they were PHP objects. PHP 5 also includes a SOAP module, allowing interoperability with Web services, and extended database support that takes advantage of the new engine's object-oriented extensibility.

As with any student on campus, popularity ebbs and flows, and successful students—and standards—must evolve and grow if they're to retain that popularity. So what can developers expect in PHP 6?

"Frameworks are being built at the moment, and there are PHP community projects under way," says Rendell. "The language will be adopting features such as Unicode support, which is planned for PHP 6. This is an important part of becoming an enterprise-grade language, and we see PHP establishing itself as one of the three main pillars of technology for building Web applications: Java, .NET, and PHP."

The article is orgiganly done by Rich Schwerin for Oracle Magazine, Rich Schwerin is a product marketing manager with Oracle Technology Marketing. The article is also republished on terminalcult.org

Tessie

Why this post? First of all, because this is my weblog and I can post whatever I like and because I really like the Dropkick Murphys and because I really like this song. As a fan I think I can pollute this weblog with some music.

"Tessie" is the title of a Broadway song, as well as another song about how the singing of "Tessie" helped the Boston Red Sox win the first World Series in 1903.

In 2004, the Boston-area punk rock group Dropkick Murphys recorded a cover of "Tessie," released on a five-cut CD single of the same name (and also featured as the bonus track on their June, 2005 release, "The Warrior's Code"). The Murphys said it was their intent to "bring back the spirit of the Rooters and to put the Red Sox back on top." Oddly enough, the goal of the Murphys was realized when later that year the Boston Red Sox won their first World Series in 86 years.

The second "Tessie" — which featured backing vocals from Red Sox players Johnny Damon, Bronson Arroyo, and Lenny DiNardo, Red Sox Vice President of Public Affairs Dr. Charles Steinberg; and Boston Herald sportswriter Jeff Horrigan (who co-wrote the new lyrics with the Murphys) — has become a theme song for the Red Sox and tells the story of how the Royal Rooters stormed the park one time when they found the game was already sold out:

"Tessie"

Tessie is the Royal Rooters rally cry
Tessie is the tune they always sung
Tessie echoed April through October nights
After serenading Stahl, Dinneen and Young
Tessie is a maiden with a sparkling eye
Tessie is a maiden with a love
She doesn't know the meaning of her sight
She's got a comment full of love
And sometimes when the game is on the line
Tessie always carried them away
Up the road from "Third Base" to Huntington
The boys will always sing and sway

Two! Three! Four!

Tessie, "Nuf Ced" McGreevey shouted
We're not here to mess around
Boston, you know we love you madly
Hear the crowd roar to your sound
Don't blame us if we ever doubt you
You know we couldn't live without you
Tessie, you are the only only only

The Rooters showed up at the grounds one day
They found their seats had all been sold
McGreevey led the charge into the park
Stormed the gates and put the game on hold
The Rooters gave the other team a dreadful fright
Boston's tenth man could not be wrong
Up from "Third Base" to Huntington
They'd sing another victory song

Two! Three! Four!

Tessie, "Nuf Ced" McGreevey shouted
We're not here to mess around
Boston, you know we love you madly
Hear the crowd roar to your sound
Don't blame us if we ever doubt you
You know we couldn't live without you
Tessie, you are the only only only

The Rooters gave the other team a dreadful fright
Boston's tenth man could not be wrong
Up from "Third Base" to Huntington
They'd sing another victory song

Two! Three! Four!

Tessie, "Nuf Ced" McGreevey shouted
We're not here to mess around
Boston, you know we love you madly
Hear the crowd roar to your sound
Don't blame us if we ever doubt you
You know we couldn't live without you
Tessie, you are the only only only
Don't blame us if we ever doubt you
You know we couldn't live without you
Boston, you are the only only only
Don't blame us if we ever doubt you
You know we couldn't live without you
Red Sox, you are the only only only

Mars Orbiter Passes Communications Relay.

An orbiting NASA spacecraft just starting to study Mars with six science instruments has successfully tested another key part of its payload, a versatile radio for relaying communications with robots on the surface of Mars.

During its first relay test since reaching Mars in March, the Mars Reconnaissance Orbiter used this radio payload, called Electra, in a two-way link with NASA's Mars Exploration Rover Spirit. The orbiter has dual roles as a science mission and a telecommunications satellite. It will support communications between Earth and future Mars surface missions, such as the 2007 Phoenix Mars Lander and 2009 Mars Science Laboratory.

"The successful test establishes Mars Reconnaissance Orbiter as a key element of our Mars telecommunications infrastructure," said Chad Edwards, chief telecommunications engineer of the Mars Network Office at NASA's Jet Propulsion Laboratory, Pasadena, Calif. "With its Electra relay payload, this orbiter will play a critical role in providing robust, high-bandwidth communications links for our future landers later this decade and into the next. It will increase the science return from these missions and enhance our virtual presence on the Martian surface."

JPL's Jim Graf, project manager for Mars Reconnaissance Orbiter, said, "Our primary science phase started Nov. 7, and this successful Electra test shows we're also in good shape for the following phase, the relay phase of the mission. Both phases will make good use of our orbiter's capability for sending data to Earth at up to 10 times the rate of any previous Mars mission."

Using Mars orbiters as radio relays to increase data return from rovers and other landers reduces the mass and power the surface spacecraft need for communications. To build the relay network cost-effectively, NASA includes a relay communications payload on each of its science orbiters.

Mars Global Surveyor, at Mars since 1997, and Mars Odyssey, there since 2001, established a relay capacity that the twin rovers Spirit and Opportunity have used extensively since their 2004 landings. More than 96 percent of the data returned from the rovers has come to Earth via energy-efficient relay through those two orbiters, at much higher data rates than the rovers can achieve on their direct links to Earth.

The Electra package on Mars Reconnaissance Orbiter, like the relay radios on Global Surveyor and Odyssey, uses an ultra-high-frequency (UHF) portion of the radio spectrum. In addition to its relay function, Electra can also be used by surface missions, or by future spacecraft approaching Mars, to determine their positions with precision and to synchronize their clocks.

During last week's tests, Electra initiated a relay session by hailing the Spirit rover. Spirit responded with its own relay radio, and the two spacecraft established a link at 8 kilobits per second on the forward link from Mars Reconnaissance Orbiter to Spirit and 128 kilobits per second from Spirit back to the orbiter. Both radios used a communications standard called the Proximity-1 Space Link Protocol, established by the international Consultative Committee for Space Data Systems for ensuring compatible and gap-free communications on such relay links.

During the four-minute session, the orbiter delivered five commands to the rover, and the rover sent up 30 megabits of information, which the orbiter subsequently transmitted to Earth for delivery to the rover's operations team at JPL.

Nearly all of the signal-processing capabilities of Electra can be reprogrammed in flight, giving it more flexibility than earlier spacecraft relay radios.

"Electra is NASA's first software-defined radio sent to deep space," said JPL's Tom Jedrey, manager for the Electra payload. "From the ground, we can change the fundamentals of its signal processing whenever that is helpful. This means it will be able to accommodate new communication protocols and signal-processing methods over the course of the Mars Reconnaissance Orbiter's operational life."

Additional information about Mars Reconnaissance Orbiter is available online at http://www.nasa.gov/mro . The mission is managed by JPL, a division of the California Institute of Technology in Pasadena, for the NASA Science Mission Directorate, Washington. Lockheed Martin Space Systems, Denver, is the prime contractor for the project and built the spacecraft.

Friday, November 17, 2006

Apophis

It's called Apophis. It's 390m wide. And it could hit Earth in 31 years time. A meteorite on a collision course with planet earth. When it hits the earth atmosphere and moments later the surface it will make a hell of show and that is a very big understatement.

In Egyptian myth, Apophis was the ancient spirit of evil and destruction, a demon that was determined to plunge the world into eternal darkness. And this Apophis could very well do the same thing. Nasa has estimated that an impact from Apophis, which has an outside chance of hitting the Earth in 2036, would release more than 100,000 times the energy released in the nuclear blast over Hiroshima. Thousands of square kilometres would be directly affected by the blast but the whole of the Earth would see the effects of the dust released into the atmosphere.

And, scientists insist, there is actually very little time left to decide. At a recent meeting of experts in near-Earth objects (NEOs) in London, scientists said it could take decades to design, test and build the required technology to deflect the asteroid. Monica Grady, an expert in meteorites at the Open University, said: "It's a question of when, not if, a near Earth object collides with Earth. Many of the smaller objects break up when they reach the Earth's atmosphere and have no impact. However, a NEO larger than 1km [wide] will collide with Earth every few hundred thousand years and a NEO larger than 6km, which could cause mass extinction, will collide with Earth every hundred million years. We are overdue for a big one."

Apophis had been intermittently tracked since its discovery in June last year but, in December, it started causing serious concern. Projecting the orbit of the asteroid into the future, astronomers had calculated that the odds of it hitting the Earth in 2029 were alarming. As more observations came in, the odds got higher.

Having more than 20 years warning of potential impact might seem plenty of time. But, at last week's meeting, Andrea Carusi, president of the Spaceguard Foundation, said that the time for governments to make decisions on what to do was now, to give scientists time to prepare mitigation missions. At the peak of concern, Apophis asteroid was placed at four out of 10 on the Torino scale - a measure of the threat posed by an NEO where 10 is a certain collision which could cause a global catastrophe. This was the highest of any asteroid in recorded history and it had a 1 in 37 chance of hitting the Earth. The threat of a collision in 2029 was eventually ruled out at the end of last year.

Alan Fitzsimmons, an astronomer from Queen's University Belfast, said: "When it does pass close to us on April 13 2029, the Earth will deflect it and change its orbit. There's a small possibility that if it passes through a particular point in space, the so-called keyhole, ... the Earth's gravity will change things so that when it comes back around again in 2036, it will collide with us." The chance of Apophis passing through the keyhole, a 600-metre patch of space, is 1 in 5,500 based on current information.

There are no shortage of ideas on how to deflect asteroids. The Advanced Concepts Team at the European Space Agency have led the effort in designing a range of satellites and rockets to nudge asteroids on a collision course for Earth into a different orbit.

No technology has been left unconsidered, even potentially dangerous ideas such as nuclear powered spacecraft. "The advantage of nuclear propulsion is a lot of power," said Prof Fitzsimmons. "The negative thing is that ... we haven't done it yet. Whereas with solar electric propulsion, there are several spacecraft now that do use this technology so we're fairly confident it would work."

The favoured method is also potentially the easiest - throwing a spacecraft at an asteroid to change its direction. Esa plans to test this idea with its Don Quixote mission, where two satellites will be sent to an asteroid. One of them, Hidalgo, will collide with the asteroid at high speed while the other, Sancho, will measure the change in the object's orbit. Decisions on the actual design of these probes will be made in the coming months, with launch expected some time in the next decade. One idea that seems to have no support from astronomers is the use of explosives.

Prof Fitzsimmons. "If you explode too close to impact, perhaps you'll get hit by several fragments rather than one, so you spread out the area of damage."

In September, scientists at Strathclyde and Glasgow universities began computer simulations to work out the feasibility of changing the directions of asteroids on a collision course for Earth. In spring next year, there will be another opportunity for radar observations of Apophis that will help astronomers work out possible future orbits of the asteroid more accurately.

If, at that stage, they cannot rule out an impact with Earth in 2036, the next chance to make better observations will not be until 2013. Nasa has argued that a final decision on what to do about Apophis will have to be made at that stage.

"It may be a decision in 2013 whether or not to go ahead with a full-blown mitigation mission, but we need to start planning it before 2013," said Prof Fitzsimmons. In 2029, astronomers will know for sure if Apophis will pose a threat in 2036. If the worst-case scenarios turn out to be true and the Earth is not prepared, it will be too late. "If we wait until 2029, it would seem unlikely that you'd be able to do anything about 2036," said Mr Yates.

Wednesday, November 15, 2006

Architecture and Security

In his CRYPTO-GRAM of November 15, 2006 Bruce Schneier, Founder and CTO Counterpane Internet Security, Inc is discussing Architecture and Security. Please find the article below.

You've seen them: those large concrete blocks in front of skyscrapers, monuments and government buildings, designed to protect against car and truck bombs. They sprang up like weeds in the months after 9/11, but the idea is much older. The prettier ones doubled as planters; the uglier ones just stood there.

Form follows function. From medieval castles to modern airports, security concerns have always influenced architecture. Castles appeared during the reign of King Stephen of England because they were the best way to defend the land and there wasn't a strong king to put any limits on castle-building. But castle design changed over the centuries in response to both innovations in warfare and politics, from motte-and-bailey to concentric design in the late medieval period to entirely decorative castles in the 19th century.

These changes were expensive. The problem is that architecture tends toward permanence, while security threats change much faster. Something that seemed a good idea when a building was designed might make little sense a century -- or even a decade -- later. But by then it's hard to undo those architectural decisions.

When Syracuse University built a new campus in the mid-1970s, the student protests of the late 1960s were fresh on everybody's mind. So the architects designed a college without the open greens of traditional college campuses. It's now 30 years later, but Syracuse University is stuck defending itself against an obsolete threat.

Similarly, hotel entries in Montreal were elevated above street level in the 1970s, in response to security worries about Quebecois separatists. Today the threat is gone, but those older hotels continue to be maddeningly difficult to navigate.

Also in the 1970s, the Israeli consulate in New York built a unique security system: a two-door vestibule that allowed guards to identify visitors and control building access. Now this kind of entryway is widespread, and buildings with it will remain unwelcoming long after the threat is gone.

The same thing can be seen in cyberspace as well. In his book, "Code and Other Laws of Cyberspace," Lawrence Lessig describes how decisions about technological infrastructure -- the architecture of the internet -- become embedded and then impracticable to change. Whether it's technologies to prevent file copying, limit anonymity, record our digital habits for later investigation or reduce interoperability and strengthen monopoly positions, once technologies based on these security concerns become standard it will take decades to undo them.

It's dangerously shortsighted to make architectural decisions based on the threat of the moment without regard to the long-term consequences of those decisions.

Concrete building barriers are an exception: They're removable. They started appearing in Washington, D.C., in 1983, after the truck bombing of the Marines barracks in Beirut. After 9/11, they were a sort of bizarre status symbol: They proved your building was important enough to deserve protection. In New York City alone, more than 50 buildings were protected in this fashion.

Today, they're slowly coming down. Studies have found they impede traffic flow, turn into giant ashtrays and can pose a security risk by becoming flying shrapnel if exploded.

We should be thankful they can be removed, and did not end up as permanent aspects of our cities' architecture. We won't be so lucky with some of the design decisions we're seeing about internet architecture.

This essay originally appeared in Wired.com.

Concrete barriers coming down in New York.

Activism-restricting architecture at the University of Texas.

Commentary from the Architectures of Control in Design Blog.

Tuesday, November 14, 2006

Robot sentinella

Samsung has partnered with Korea university and developed the machine-gun equipped robotic sentry. It is equipped with two cameras with zooming capabilities one for day time and one for infrared night vision. It has a sophisticated pattern recognition which can detect the difference between humans and trees, and a 5.5mm machine-gun. The robot also has a speaker to warn the intruder to surrender or get a perfect headshot. The robots will go on sale by 2007 for $ 200,000 and will be deployed on the border between North and South Korea.

This news reminds me of the rules of robotics which are set by Isaac Asimov Even do Asimov was a writer of SF books the things he wrote about ethics for robots are accepted by the majority of the scientific community building robots.

- A robot may not injure a human being or, through inaction, allow a human being to come to harm.

- A robot must obey orders given it by human beings except where such orders would conflict with the First Law.

- A robot must protect its own existence as long as such protection does not conflict with the First or Second Law.

The US army also already has some armed robots and this also is considered against moral standards by a large number of leading researchers. As already stated Asimov was a novel writer however the things he wrote on this subject are a good and clear guideline, which should be respected by researchers and companies in my opinion.

Robot sentinella
Uploaded by Alice_in_Wonderland

Sunday, November 12, 2006

NASA and open-source software.

NASA, Notional Aeronautics and Space Administration, can be considered as one of the largest US government funded research institutes. As all research institutes at this moment there is a large amount of open-source software involved. A large number of there researchers are using Linux on there computers and a large number of there servers are running on Linux.

Also a lot of the researchers at NASA are giving back open-source software and enhancements to the open-source community. Also they have some projects running completely devoted to open-source. For example the “World Wind” project which is a open-source project. This project is licensed under “NASA OPEN SOURCE AGREEMENT VERSION 1.3”

The big advantage of open-source at NASA is that the community can tap into the knowledge of NASA and there are some very nice projects you can download and participate in. Some good places to take a look are for example the “Ames Research Center” or the “Goddard Space Flight Center, Office of Technology Transfer”. Also a good place to take a first look is at this location.

Here you can find links to projects like:

ACE: aCe (Architecture Adaptive Computing Environment) is a project to develop a programming environment that can be supported on all computing architectures.

ECHO:The EOS ClearingHOuse (ECHO) is an enabling framework being built by NASA's Earth Science Data and Information System (ESDIS) Project to allow different data systems and services to work together. ECHO is an open system based on Extensible Markup Language (XML) and Web Service technologies; its Application Program Interfaces (APIs) are published for use by the science community to exchange data, information, and services.

OSAL: The Operating System Abstraction Layer is a small software library that isolates embedded system software from a real time operating system. The project includes an Operating System Application Program Interface (API), a Hardware Abstraction Layer API, implementations for several real time and desktop operating systems, and a project build system.

Livingstone2: Livingstone2 is a reusable artificial intelligence (AI) software system designed to assist spacecraft, life support systems, chemical plants or other complex systems in operating robustly with minimal human supervision, even in the face of hardware failures or unexpected events.

CODE: CODE is a software framework for control and observation in distributed environments. This framework enables the observation of distributed resources, services, and applications. Observations are made by modular components called sensors, the information observed is encapsulated as events, and these events are transmitted from where they are produced to whoever wants to consume them using an event management framework. Further, the CODE framework allows people or agents to control a distributed system by allowing them to take actions on remote systems using modular components called actors.

Surfer: Surfer is a general-purpose framework for selecting and ranking grid resources based on user constraints and preferences. Surfer has no built-in bias towards any job model or selection policy, thus is suitable for inclusion in any grid environment by adding information providers knowledgeable about that environment. Information is pulled from these providers as needed allowing Surfer to efficiently handle large and complex information sources unsuitable for push-based models. Surfer has been implemented as an OGSI-compliant grid service that can also be embedded directly into Java applications through its APIs or into non-Java applications through its XML-based command-line interface.

JavaGenes: JavaGenes is a fairly general purpose evolutionary software system written in Java. It implements several versions of the genetic algorithm, simulated annealing, stochastic hill climbing and other search techniques. JavaGenes has been used to evolve molecules, atomic force field parameters, digital circuits, Earth Observing Satellite schedules, and antennas. The digital circuit searches didn't work very well and the code isn't here. The antenna code is not, and may never be, available for open source distribution. Compared to version 0.7.28, this version includes the molecule evolution code and a number of other improvements.

Saturday, November 11, 2006

Man-cgi on terminalcult.org

The man command in UNIX and Linux environments give you a manual page about a specific command while you are working in a terminal environment. This can be convenient while working on the terminal however from time to time you might want to explore some commands when you do not have access to a command shell.

Panagiotis Christias created a shell-sed-awk script which converts on the fly the output of the "man" command to HTML named Man-cgi. The university of Alabama installed this on a Sun Solaris. On my website terminalcult.org I created a interface to the Sun machine at UA and parsed the HTML output into the format of the terminalcult website. So now it is possible to explorer the Sun Solaris commands from my website.