Derick Rethans

Even if you're not using PHP I highly recommend reading Derick Rethans's slides on Date and Time. There's lots of good information there, especially about all the various quirks with timezones. http://derickrethans.nl/talks/time-zendcon9.pdf, you may even be able to find a video of him presenting this.

Yes! I remember downloading this for working in an offline setup 20+ years ago. Still, maybe getting rid of the mirrors program 5 years ago had its downsides: https://derickrethans.nl/php-mirrors.html

I think the article on this, explains why a memory reduction by garbage collection also increases execution speed: http://derickrethans.nl/collecting-garbage-performance-considerations.…

Some discussion about this method at http://derickrethans.nl/immutable-datetime.html

I spent 10-15 minutes poking around php internals newslist for an explanation of the php 5.4 changelog "improved performance of the (@) silence operator" without luck. It's just listed as a zend engine improvement without specifications. Someone posted here a clear example of why (in earlier php5) it generates far worse opcode: http://derickrethans.nl/five-reasons-why-the-shutop-operator-should-be…

I believe these obfuscators work by forcing you to install a binary-only .so zend extension in php.ini, which intercepts these encoded files. The files themselves should decode to already-halfway-parsed PHP opcodes or so, which is probably injected into the PHP/Zend virtual machine. Figuring out the encoding scheme is probably a lot of boring disassembly work, which in the end just lets you decode a bunch of PHP opcodes which themselves would take a lot of work to make sense of. But perhaps the Vulcan Logic Dumper could help out a little bit. http://derickrethans.nl/projects.html#vld

Not even the maintainers really understand what they are doing : https://github.com/g0tmi1k/debian-ssh > There was an #ifndef PURIFY there for a reason. It's because the openssl authors knew that line would cause trouble in a memory debuger like Purify or Valgrind. Where a debian maintainer screwed the RNG of OpenSSL to make valgrind happy. This made any key generated on a debian or ubuntu system from 2006 to 2008 very easily breakable. Downstream should never touch packages beyond backporting fixes made by upstream. Here's another example of upstream vs downstream conflict in debian : https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=477454 Or PHP developers being fed up with both RedHat and Debian messing with their runtime on whims : https://derickrethans.nl/distributions-please-dont-cripple-php-or-red-… This is why I heavily support the desire for a new packaging system targeted at developers: snaps, flatpak. The downside of having multiple copies of the same libraries pale in comparison to giving back power to upstream. Distro maintainers are routinely modifying codebases they don't understand. Allow us to have a standard installation process that can install packages.. made by the developers themselves, upstream. Just like all other operating systems do. And Debian, unlike RHEL/CentOS, packages a lot more than they can even reasonably maintain. The vast majority of packages in a Debian stable are insecure, the security team simply…