Once you start to dig around PHP Security in earnest, you begin to notice trends and patterns in how programmers behave and accumulate knowledge. The most obvious feature of PHP culture is that we do not have an active "leadership" in security. There is no appeal to authority in PHP security debates, only personal opinions informed by a nebulous entity called "They". There are individuals that I have learned to trust and that's about as far as we can go. [...] In the PHP community, the Authorative Knowedge for PHP Security is derived from a concensus. A concensus based on published articles, the practices of libraries and frameworks, printed books, and the vague meandering thoughts of whoever you follow on Twitter. In other words, our current Authorative Knowledge is you.

He notes that this "everyman security expert" hasn't proven to be the best method for increasing the overall security awareness of PHP developers, so he's proposing something different: the "PHP Security Technical Group (SECTG)".

It's a group of members who share a common interest in sharing information, performing research, publishing articles/newsletters, and generally taking advantage of resource pooling without giving up their individual interests - all towards accomplishing some common goal, i.e. creating or emphasising new Authorative Knowledge. The phrase "Unofficial" is implicit in the group name - this is not an official PHP entity.

If you're interesting in joining in on the cause, you can sign up for the mailing list and get more information as it comes.

When I started writing my book, I wanted to help PHP developers have a greater understanding of the tools, tips and tricks available when working as part of a team. That goal became The PHP Playbook. I'm excited that the book has been so well received, and I'm excited that I've finally received my promotional copies. So, in honor of that, I'm going to give some of them away! I'm even going to sign them!

Just enter in your email address and you'll be put on a mailing list for the book and its future updates. Here's the official description of the book:

Working with a team of developers is a much different environment than solo development. Experienced developers understand the tools and tricks that go into team development enterprises, and they implement them on a daily basis. The PHP Playbook covers these tools and practices, providing insight into the process of developing PHP applications, teaching developers the skills they need to be successful in a team environment.

Today Rasmus mentioned that he received a $500 offer for the php.net domain name. Discussion ensued, which ultimately led to the indisputable belief that php.net is worth over 10 million US dollars. Therefore, let's think about this further...

He compares the worth of several popular languages (with a "reliable source") and does some math where PHP.net account holders would profit from the popularity over other languages. On a bit more serious note, though, he points out a few ways that you can contribute or get involved in the PHP project on several fronts:

• Help by editing documentation
• Sign up for a mailing list or three
• Get a SVN account and start contributing back to the code

PHP core developers are planning to kill the PHP original MySQL extension. If you are using MySQL in your PHP applications for a long time, this may seriously affect you.

Right now it's just in the proposal states (as suggested by Philip Olson) but, if fully acted upon, could have large implications on a number of PHP applications currently using MySQL. For now, though, Philip is only suggesting an education of the PHP user base that they should migrate to either pdo_mysql or mysqli for the future of their apps. Most of the comments following in the mailing list thread are supportive of the effort. They note that it won't be an easy task and, in the end, will still be a "bitter pill" for developers to swallow when the switch is finally thrown.

For the full thread of this discussion, see here and keep clicking through on the "next in thread" link.

What's this nonsense then? Well, a few weeks ago I shot myself in the foot [...] and before my sanity returned to normal, I found myself hoodwinked on IRC into writing up weekly summaries of what is discussed in Zend Framework land.

The posts will try to bring together some of the major topics from the last week on the list. This week's features include the "where do things go?" question about files/resources, how to package up a Zend Framework 2 application, the View component in ZF2 and a few other topics. If you'd like to keep up with these weekly posts, you can follow along on the php-general tag on Padraic's blog.

Discussion on the PHP mail lists and IRC channels in the past few days has been looking positive about an alpha release of PHP 5.4 soon. This will be taken from the "trunk" branch of PHP. The exact feature list is under discussion but the mood seems to be "ship what we currently have" though a couple of features are slated to be deferred until later.

He specifically mentions this mailing list post and the emphasis he puts on testing the code. If you'd like to get involved, you can subscribe to the mailing lists here.

Reading code is not only fun, its also a great way to exercise your brain - not to mention a fantastic way to discover new ways to solve problems. At work (we are hiring btw!), for example, I read pretty much every single commit (and merge requests, for that matter) - and I'm subscribed to several different OSS commit lists. I can't say I read every commit to PHP, I focus on the areas I care about, but I do skim over the rest - if only just to see when new features are added.

He talks about the various mailing lists that are around the PHP project (like the documentation, PEAR and PECL ones) and how many of the subscribers are cross-list, following along with multiple parts of the project.

Just the simple fact that I know people will be reading through my commits makes me think about what I am doing a bit more; "Is this really needed?", "Is there be a better way solving this?", "Could it potentially break other things?", "Is this actually correct?".. The people who review the commits often don't seem like the friendliest people in the world.. If there are issues with the commit; You will be told. No doubt about it.

What's the side effect I mentioned? Hannes' account credentials were hacked but, because of the code review process, a random commit from another developer was caught.

We're a bit further along now; and with the typehinting resolved (http://thread.gmane.org/gmane.comp.php.devel/62298/focus=62858) I want to start started with PHP 5.4 with the first alpha on Wednesday, November 24th. There are a few things that need sorting out and/or clarification: Annotations, Lemon rewrite, APC in trunk.

Keep in mind that this is only the very start of the process, so depending on any bumps along the way, PHP 5.4 may still be a bit out. Check the main PHP site for updates on betas and final releases as they become available.

The popular email campaign manager phpList is open source, free to download and easy to use. The company Tincan is the commercial sponsor behind phpList, which comes in two forms: a hosted solution or a download that you can set up yourself on your server. If you don't want to go through the hassles of setting up and managing the system, you should go for the hosted solution. [...] Otherwise, you could just follow this article to set up phpList on your own and save yourself a few bucks.

The tutorial links you to the download you'll need to get this mailing list software and the instructions on how to get it all set up. They show you how to create lists and add users to them and how to send a simple message to a list. There's a few things they also show you how to "hack" on in the code like automatically confirming subscriptions, not sending the welcome email and removing the "powered by" image in the default emails.

As I mentioned, I will pick some tasks up myself but I can not do it all! For that reason, I would like to form a group of people who are interested in helping out. Whether you can dedicate only a few hours a month or a day a week, it doesn't matter. Now, I could make my own little list of people who want to help but what use is that when we can openly discuss things. So I have created a new mailinglist just for this purpose: symfony-community.

The mailing list will provide a place for members of the community to talk with each other and work together on the Symfony project as well as being a place where initiatives for the framework can be discussed.