It's cool that he got so much press in such a short time, but applauding technology choices that allowed him to sustain 8 requests per second (assuming this was over a 12 hour period) is ridiculous.
Considering that lots of peoples blogs die because they get 10k visitors from HN. His small $15 vps did fine.
Never seen $found = `grep $udid FILE` using back-ticks in PHP land. Is that the same as the exec() function?
It's still relatively unsafe, as it invokes external programs through a shell, so you're dependent on the shell's environment, which can diverge on different systems. Last I checked, PHP did not have an easy, obvious way to safely invoke another program. You can do it manually with a mix of pcntl_fork and pcntl_exec, but capturing the output using that is more difficult.
Is there any shell on which those functions are unsafe ? I think they assume cmd.exe on windows and sh on others.
The right thing to do is provide an output capturing API that does not require escaping because it takes a list of strings passed to the exec(2) system call.
Just for comparison, in 1998/99 I ran an mp3 search engine that handled 200k daily queries at the peak. It was a Pentium with 128MB of memory. The search server was written in C, and it used an inverted index. The system load rarely went over 1.