Slashdot Mirror

← Back to Domains

Domain: codesimply.net

Stories and comments across the archive that link to codesimply.net.

Comments · 12

  1. not just like any other language out there by brlewis · · Score: 1 · on TinyDisk, A File System on Someone Else's Web App
    If 99% of security problems come from using external data without checking it, wouldn't it make sense to have a syntax that enumerated your external inputs like BRL has had for the past 6 years? Or better, one shows how each input is validated like BRL has had for 2 years with define-input ?

    This would have been a straightforward feature to copy/adapt into PHP if anyone were interested in making it a decent server-side web language.

    Don't say "just like in any other language" when you're unaware of languages out there that are more suited to web applications.

  2. filtered on input by brlewis · · Score: 1 · on PHP Security Consortium Launched

    Your example shows filtering on output. Which part of "filtered on input" did you not understand? If you accept input, you need to filter input. Telling programmers to work harder if they are not filtering input is the right approach. If PHP had imitated the BRL define-input syntax it would be easier. Easy or not, it has to be done.

  3. Re:I've said it before, and I'll say it again by brlewis · · Score: 1 · on PHP Vulnerabilities Announced
    Perhaps you've been asleep when every other software package releases updates/bug-fixes/security patched.
    Bzzst. BRL's define-input syntax bypassed the whole register_globals mess. A similar syntax could have been used in PHP to give some of the register_globals simplicity without the security holes. The PHP community can talk about high horses when it overcomes its own NIH syndrome and starts copying good ideas from elsewhere.
  4. pack()/unpack() fault by brlewis · · Score: 0, Offtopic · on PHP Vulnerabilities Announced

    Java serialization and deserialization aren't vulnerable to such attacks, and neither is Scheme's read/write. BRL users needn't worry.

  5. Why no multipart/form-data support by brlewis · · Score: 2 · on 2.4 Servlet Spec Reviewed

    An HttpServletRequest should really handle multipart/form-data requests right out of the box. I shouldn't have to merge in some third-party software if I want BRL to support file uploads. Why has it not yet been standardized?

  6. Get the most out of that aging single server by brlewis · · Score: 3, Informative · on PHP Scales As Well As Java

    Jetty running on that single aging server will blow the doors off of PHP. That's what I saw when I did some BRL benchmarking some time ago. Presumably you'll get similar results with JSP.

  7. Performance scalability? Can that be right? by brlewis · · Score: 1 · on PHP Scales As Well As Java

    Back when I was concerned about whether BRL had decent performance, I did a simple benchmark on a 586 Debian box with Apache/php3 vs Apache/Jserv/BRL. PHP could beat BRL if BRL used Sun's JRE, but BRL beat PHP using IBM's JRE. When I switched from Apache/JServ to a Jetty server, BRL totally blew PHP away. I tried again when PHP4 made it into Debian, and surprisingly saw no significant difference.

    BRL's architecture is much like JSP, except BRL may be faster on the first request as it compiles a simpler language with no intermediate Java source. I would expect JSP to perform as well against PHP as BRL did, if not better.

  8. PHP in Investment Management by brlewis · · Score: 1 · on PHP Usage in the Enterprise

    The web site for Eaton Vance got a new look today. Some ASP pages were replaced with PHP. I wish they had used BRL, but they liked that there were published cookbooks for PHP.

  9. emails, PDFs by brlewis · · Score: 1 · on Jakarta Velocity Tools 1.0 Released

    You can use BRL that way. See the testsuite directory in the source distribution for how to process BRL files without any web framework. Additionally, there's a builtin function for LaTeX-escaping strings, in case you want really nicely formatted PDF reports, as I do. Additionally, when you embed code to generate an email within a file that generates a web page, the same nice template syntax is used as at the top level, unlike any similar technology that I'm aware of.

  10. 100% logic/presentation separation: never true by brlewis · · Score: 1 · on Jakarta Velocity Tools 1.0 Released
    i'll get modded to an oblivion for this but
    I have moderator points and could have modded you down, but I'd rather reply.
    using VB.NET theres 100% logic/presentation seperation
    This, as always, is untrue. There is no such thing as 100% logic/presentation separation. Suppose you have a wide table that is the result of a database query. Should you make every third row a different background color to ease horizontal navigation? Every other row? Just leave them all the same background color? This decision is both a presentation decision and a logic decision. How many decimal places should you show for this particular number? There's another decision where logic and presentation are intertwined. Clearly both the model matters (How many decimal places are necessary for the entity to have meaning?) and the view matters (How much horizontal space do I have on this report?) I could go on and on with examples where you cannot separate the logic from the presentation.

    You can partially separate logic and presentation. How much separation is appropriate depends on the project...actually on individual instances within the project of logic/presentation relationships.

    There are lots of people out there who do too little separation of presentation and logic. They'll end up with a better end result if they use Velocity, Freemarker or webmacro. There may also be people out there who produce overly bland user interfaces because they try too hard to separate presentation and logic. They would benefit from JSP, BRL, Tea, PHP, CF, or somesuch. Although with BRL it's easier to extricate the logic from the presentation if you start out with too little separation.

    OK, enough ranting. It's just that this "100% separation" fiction is one of my pet peeves.

  11. Re:What I hate about PHP... by brlewis · · Score: 1 · on What I Hate About Your Programming Language

    Very few pages benefit from threading, so I'm not surprised PHP hasn't made it a priority. You could always code most of your project in PHP, but use a thread-enabled language like BRL for those few pages.

  12. Re:Actually PHP is a hack of a language by brlewis · · Score: 1 · on What I Hate About Your Programming Language
    >PHP is a language that was designed for small, simple CGI scripts, and it does this well.

    I maintain that BRL kicks PHP's butt when it comes to small, simple CGI scripts.