Montreal Tech Watch

I met Philippe Gamache for the first time at a codefest (a phpquebec event); where he discussed web vulnerabilities and potential security problems. The discussions were focused on php, however I found his comments extremely insightful. He was then at MOBIVOX, a Montreal voip startup.

Things have changed since then, my rails application are much more secure :-) , and for Philippe, the big news is that he’s opening Sensio Canada Labs, here in Montreal. Sensio does a php web framework called symfony, very similar in nature to Ruby on Rails or Django. The framework started out in France, and due to its popularity, especially in enterprise environments, they have now plans for international expansion. I took then the opportunity to ask questions to Philippe, who is to manage the Canada offices and also launch training sessions.

This “interview” was done via the web, although we did catch up and discussed in detail about the symfony project at last week’s codefest.

Can you present yourself, your background, and also what has been your experience and involvement with the symfony project?

Wow, you begin by a tough one. My name is Philippe Gamache. I’m the office manager of Sensio Labs Canada. I’m a security consultant specialize in PHP security. I wrote a security book “Sécurité PHP 5 et MySQL” with Damien Seguy a PHP specialist.

Virtual communities were my first passion. I began playing with BBS in 1988. In 1989, someone introduce me to the Internet. At the same time, I discover (real) programming. I did some modification on my own BBS, and a pirate did try to attack us. So I did discover the importance of good security. With the introduction of BBS network like FIDONet, more and more attack came into play. So to understand how attacker where working, I did “infiltrated” some groups, working as an ANSI artist.

In 1992, I began bridging my BBS with Internet service like email and Usenet (news groups). BBS was losing traction, so in 1994, I did my first personal and professional website. It’s only in 1996 that I did my first virtual community. Now, I’m managing three such communities. Unfortunately, none of them are in symfony for the moment, but there is a test version for all of them, with symfony.

Over the years, I did work on many projects (mostly in PHP): web games, forums, cryptography, authentication systems, and more.

The move to symfony was a professional one for me. I was doing MOBIVOX website at the time. The web team was growing, and we needed to have a better working process. There where an others problem: website translation. We did have a translation process, but it was only good for Latin language, like English or French. We wanted to have Chinese. So, we look to find a new framework. We look different frameworks: Zend Framework, eZ components, Seagull, CakePHP, Solar and symfony. We looks at different points for each framework: technical qualities, easy of use, support and the community around it. Symfony did come first on each count (some where even with some others framework).

Open source projects work on the principle, I take and I give back. Because, I did like so much symfony, I work on moving my personal projects to it. So, how could I give back? Yes, there where some plug-ins that I’ll give back to the community, but I wanted something more concrete. So I imagine a project I call SecureSymfony. It’s basically a set of plug-in for different security concerns, like multi-factor authentication, cryptography and auditing.

Can you present quickly symfony and what it does? What would it bring to a company that didn’t use previously a tool similar to symfony?

Symfony is a full-stack framework written in PHP5. It provides architecture, components and tools for developers to build complex web applications faster. The very small number of prerequisites make symfony easy to install on many configuration; you just need *nix or Windows with a web server and PHP installed. In addition, it has a very small overhead, so the benefits of the framework don’t come at the cost of an increase of hosting costs.

Using symfony is so natural and easy for people used to PHP and the design patterns of Internet applications that the learning curve is reduced to less than a day. The clean design and code readability will keep your delays short. Developers can apply agile development principles (such as DRY, KISS or the XP philosophy) and focus on applicative logic without losing time to write endless XML configuration files.

Symfony is aimed at building robust applications in an enterprise context. This means that you have full control over the configuration: from the directory structure to the foreign libraries, almost everything can be customized. Based on the premise of convention over configuration – the developer needs to configure only the unconventional. To match your enterprise’s development guidelines, symfony is bundled with additional tools helping you to test, debug and document your project.

It is database engine-independent, using states of the art ORM (Object-relational mapping) like Propel and Doctrine. The code is very readable using phpDocumentor comments, for easy maintenance. It is easy to extend, allowing for integration with other vendor libraries

New users join the community every day, and that makes of symfony the most popular PHP5 framework around. A large community means easy-to-find support, user-contributed documentation, plug-ins, and free applications. The documentation is available in more that 15 languages,
and there is more that 200 plug-ins.

Why would anyone pick the Symfony web framework over other web frameworks such as CakePHP, Django or Ruby On Rails?

First it’s the programming language. PHP is available almost everywhere and it’s very easy to install. Symfony is using the PEAR platform, so installing it is easy as writhing two command lines.

Symfony is based on experience. It does not reinvent the wheel: it uses most of the best practices of web development and integrates some great third-party libraries.

Then it’s scale better that the others frameworks, and because it’s lightweight, don’t need to scale as soon as others frameworks. Because we do co-operate with many of them, I’ll keep away from doing direct comparisons.

Then there is the community. It’s a great community that helps out, does new documentation every day, translates existing documentation, and produces news plugs-in almost every day. Like I said at the beginning, we didn’t choose some frameworks because of the community. Some of them are in constant war.

And, last but not least, commercial support. It’s very important for some companies, and there is hundred of companies doing it, in almost every countries.

The part 2 of the interview will come up soon, with details about Sensio, symfony and plans for Canada.

Add to: Digg del.icio.us Facebook Reddit StumbleUpon | 4 Comments »