"One of the key values at Facebook is to move fast. For the past six years, we have been able to accomplish a lot thanks to rapid pace of development that PHP offers. As a programming language, PHP is simple. Simple to learn, simple to write, simple to read, and simple to debug. We are able to get new engineers ramped up at Facebook a lot faster with PHP than with other languages, which allows us to innovate faster."

The idea of that talk is to go through the classes of vulnerabilities or security problems that you usually need to take care of yourself and look at the Zend Framework to check what internal protection ZF offers and how they are used and what problems you still need to solve on your own.

http://techportal.ibuildings.com/2009/10/13/secure-programming-with-the-...

Redis is a key-value database. It is similar to memcached but the dataset is not volatile, and values can be strings, exactly like in memcached, but also lists and sets with atomic operations to push/pop elements.

In order to be very fast but at the same time persistent the whole dataset is taken in memory and from time to time and/or when a number of changes to the dataset are performed it is written asynchronously on disk. You may lost the last few queries that is acceptable in many applications but it is as fast as an in memory DB (Redis supports non-blocking master-slave replication in order to solve this problem by redundancy).

Solr is an open source enterprise search server based on the Lucene Java search library, with XML/HTTP and JSON APIs, hit highlighting, faceted search, caching, replication, a web administration interface and many more features. It runs in a Java servlet container such as Tomcat.

Solr is a standalone enterprise search server with a web-services like API. You put documents in it (called "indexing") via XML over HTTP. You query it via HTTP GET and receive XML results.

* Advanced Full-Text Search Capabilities
* Optimized for High Volume Web Traffic
* Standards Based Open Interfaces - XML and HTTP
* Comprehensive HTML Administration Interfaces
* Server statistics exposed over JMX for monitoring

The @ “operator” in PHP is used to silence any warnings or errors that would otherwise be shown (in the browser or the log). Some people thinks it is really useful, the most suggest to avoid it.
This is an interesting blog post about the slowness of @ , one more reason to avoid hiding errors.

http://bit.ly/MVFC9

So you’re running dedicated MySQL Linux box with plenty of memory, now the good question arises: should you have swap file enabled or disabled ? I’ve seen production successfully running on boxes both with and without swap file so it is not the question of you must do it this or that way but rather understanding advantages of both approaches in your environment.

The Debian project is pleased to announce the third update of its stable distribution Debian GNU/Linux 5.0 (codename "lenny"). This update mainly adds corrections for security problems to the stable release, along with a few adjustments for serious problems.

There are many things you can do to speed up your website. This article focuses on practical things that I used, without any spending money on additional hardware or commercial software.

http://tr.im/xs6y

• Cache PHP output
• Create turbo charged storage
• Leave heavy processing to cronjobs
• Optimize your database
• Save some bandwidth
• Store PHP sessions in your database

About PHP sessions and DB usage I would like to add something: do not use them unless you really need them! Start php sessions and open db connections when needed. Do not put them in the boostrap/frontend file.
HTTP is stateless, try to keep your site/application the same, it makes caching and load balancing a lot easier.
In some context, site content related to user sessions can be loaded using ajax. And DB data can be cached into memcache.

You may also consider stracing your web processes to optimize disk usage. E.g. your Apache could be configured to look for index.html and index.htm everytime the homepage is called. See DirectoryIndex.

An article outlining the digg.com engineering teams switch from svn to git. Basically sings git's praises, without getting technical.

Git is a distributed revision control system (while svn is a centralized one) where you can perform commits, branches, merges on your local working copy, without being connected to Internet. It allows, for instance, to commit multiple local commits as a single commit, even to a svn repository.

How strong is firefox password encryption? I've seen programs on the net to recover ff passwords after you've lost your master password, and comments on hacker forums that ff uses a hackable encryption technique, not, say, AES or blowfish.