here is a quick outline of some issues in php through the years:

http://phpxmlrpc.sourceforge.net/#security early and naive implementations of xml parsers in php used eval, and as such were terribly insecure and hacked en masse

http://php.net/manual/en/security.magicquotes.php -- man, if only we wrapped string on a ini file setting, it wouldn't prevent injection attacks at all, really all it means is that the standard library isn't portable any more as the semantics and return values can change on a site basis.

http://php.net/manual/en/security.globals.php 'you know what would be good if we could trash variables from the browser' 'we've turned it off now, good thing that people won't turn it back on for older scripts, and it will affect every script'

http://php.net/manual/en/language.oop5.late-static-bindings.... - a dynamic language with an early bound oo implementation? sure we'll fix it, we'll just make the keyword for dynamic dispatch 'static'

http://php.net/manual/en/language.namespaces.php - the namespace character is the string escape character. I mean that will never backfire if people don't use 'variable functions', or using a string to lookup a function http://us.php.net/manual/en/functions.variable-functions.php lets hope we never have to put old code that uses this into a namespace.

http://php.net/manual/en/control-structures.goto.php man, should we implement a subset of goto or, should we do named breaks. nah goto is far more awesome.

http://use.perl.org/~Aristotle/journal/33448 - how do we fix a security vulnerability? why checking to see if an int is bigger than INT_MAX

www.trl.ibm.com/people/mich/pub/200901_popl2009phpsem.pdf - the implementation and semantics of php don't match up. it doesn't do what it says on the tin.

http://en.wikipedia.org/wiki/PHP_accelerator - php by default doesn't cache bytecode, unlike, nearly everything ever, for commercial reasons, as zend sell one as a product.

http://www.phpcompiler.org/doc/phc-0.2.0.3/representingphp.h... - the grammar is terribly broken, so much so it is nearly impossible to do obvious and useful things like foo(1,2,3)[0]

http://blog.php-security.org/archives/61-Retired-from-securi... the development team is toxic and reluctant to provide actual solutions for security

there are many php builtins which have vague return values which change indeterminately between releases and arguments, which forces you to use == over === for some comparisons unless you want your code to break unexpectedly.

the moral is: for everything they've fixed, they've often fixed by duct taping over the original errant feature. the standard library needs to be wrapped to be consistent. security or performance isn't a priority for the open source versions.

this won't bite most web applications as many of them are simple templates around a database.

with larger applications or frameworks, php struggles

the syntax seems regular but the grammar for php isn't.

this is why you can't do $a = foo(1,2,3)[0] in php.

also why this won't happen any time soon.

Using the sqlite db as the canonical configuration is a nice idea, but reminds me of the fun of bind, editing one file to re-generate another. It is as if he is ignoring the advice in his older post about making software usable.

Instead of having a simple text format that is the configuration, he encourages everyone to write their own. I can imagine the fun now on a mailing list - debugging n+1 languages to start a webserver.

When you deploy, do you deploy the sqlite database file or the script that generates it? Does the daemon check if the db is out of date on startup? Does the script clear the existing db when it runs? Does it have merge logic? How do you keep them in sync?

'But it's powerful' I hear you cry, but my retort is simply 'it is effort to maintain, deploy and configure'. It smacks of: here is a bus port, go build yourself a keyboard. This sort of toolsmithery is what brings us delights like autoconf.

A simple change would improve things a lot, whilst maintaining the flexibility he craves:

instead of 'generate a config file' with your tool and hand it off to mongrel, the tool you write is part of mongrel.

You write a script called /etc/mongrel/makeconfig, that takes one argument, the name of the mongrel settings database. When mongrel starts, it invokes makeconfig to build the database.

You can provide a bunch of trivial makeconfig scripts as defaults, including a shell script that just runs a bunch of sqlite statements.

> Instead of having a simple text format that is the configuration, he encourages everyone to write their own.

Uh no, you obviously didn't read the article where at the end I show you the default format we provide to you in m2sh. I think before you go waxing poetical about something you should learn more about it.

And it's not powerful, it's simple. Take a look at the code that loads the configuration in mongrel2 from sqlite, and compare that to similar C code (also written by me) in the m2sh source to just parse a config file. Code doesn't lie and in this case, parsing a config is a hell of a lot harder than just loading it out of a sqlite file.

parsing a config is a hell of a lot harder than just loading it out of a sqlite file

Is there really no library for that? </rhetorical> The usual INI file format has been unchanged since the 80s!

    [section1]
    param1=value1
    param2=value2
    ; this is a comment
    [section2]
    param3=value3

And the reason it's stuck around for so long, on every platform you can think of, is it works, it's bulletproof, and everyone understands it at a glance. Anyone can come up with their own scheme, then you end up how it is Javaland right now, where the "application" is just a runtime for the application written in a custom one-off language which is the 10,000-line XML configuration...

Anyway, the people who get called at 3am when production is down won't thank you for introducing yet another config file format.

You missed the bit where I said having a standard way of calling a script would be an improvement.

(and The bits where I asked how you would deal with keeping them in sync)

(and I missed the bit where you said m2sh was the default format, because I can't find that anywhere but in your comment here).

Agreed, the potential issue of having different people having different configuration sounds a bit dangerous. OTOH, most issues you mention are true whether you use a db or a plain configuration file - they are just more explicit with sqlite3 (which acts as the model in a MVC organization of your app settings).

Incidentally, I am thinking quite hard about those issues (configuration representation, live change/querying, versioing) for internal apps, it is not an easy issue once your app has more than a few parameters.

Python for 1,2 with a little bit of manual pasting into wolfram alpha

And for part 3 I used prolog. About ~6 lines or so.