5 ms·

These problems are not inherent to PHP. As other people have pointed out, this is what happens when you run arbitrary code on your server. Even if you took away

by nbpoole 16y ago

These problems are not inherent to PHP. As other people have pointed out, this is what happens when you run arbitrary code on your server. Even if you took away the base64 encoding and eval calls, people could still embed spammy links into the page.

lkrubner 16y ago
That is exactly why WordPress needs to get serious about security. It's current attitude has been extremely slack. Their focus has been on releasing features that allow for a more pleasant user experience, rather than releasing features that enhance security. Above I compare the attitude of Microsoft to the attitude of Automattic. Justifiable criticism was aimed at Microsoft for promoting fun new user abilities, rather than security, in both DOS and Windows, for a long time. The same kind of criticism can be aimed at Automattic. What can they do? At the very least, they can automate the test that Siobhan Ambrose does in the above article linked to by this thread.
- nbpoole 16y ago
  Automate what test? Searching for calls to base64_encode? Five minutes after they do that, people will write their own base64-encoding functions. Security by blacklist is not security at all.
  - lkrubner 16y ago
    My friend, your comment is remarkably besides the point. If we can agree that the WordPress team needs to focus on security, then we are basically in agreement. The details of how to do this can hopefully worked out by the WordPress team. They have certainly been given good advice over the years, much of which they have tended to ignore. Perhaps they will begin to listen. Given the scale of WordPress's success, we must hope they reform their ways. Ideally, at some point soon they will recognize some of the dangers that arise from using such an easy-to-set-up language as PHP, and they will recognize that they appeal to a largely non-technical audience, and they will start taking some responsibility for their choices, and their success.
    - henrikschroder 16y ago
      > My friend, your comment is remarkably besides the point. In what way? You don't seem to understand how useless black-list codescanning is, a competent malicious programmer will find ways around those in minutes. > Ideally, at some point soon they will recognize some of the dangers that arise from using such an easy-to-set-up language as PHP Dangers such as?
      - lkrubner 16y ago
        You write: "Dangers such as?" I find it hard to believe that you do not know the dangers. Please google "php sucks" or "php security" and you will discover thousands of articles that address what I referenced above when I wrote "the dangers that arise from using such an easy-to-set-up language as PHP". I also just posted a long comment up above in this thread, where I post quotes from several articles that have described the insecurity and disorganization that PHP makes so easy to achieve. You can view it here: http://news.ycombinator.com/item?id=2131602 http://news.ycombinator.com/item?id=2131602
        lkrubner 16y ago
        Or, here is another: ------------ But PHP has more than a few security bugs: in many ways PHP is fundamentally flawed. The program, whose initials originally stood for Personal Home Page, was designed without much thought given to security. Many of the PHP features that make it really easy to write a Web application also make it really difficult to write one that's secure. All of this matters just now because Stefan Esser, the founder of the Hardened-PHP Project and the PHP Security Response Team (which he recently quit), has threatened to make March the "month of PHP bugs." By that, Esser means that he is going to be releasing a series of security bugs in March that show the world just how unsecure PHP actually is. What's driving Esser is both a desire to make PHP more secure and a good touch of anger and resentment at the current PHP developers who have taken many of his security patches and incorporated them into the program without giving Esser any credit. You can read more about his motivations in his blog entry and in the interview that he did with Security Focus. How will this affect users of the Web? Well, a recent "Month of Bugs" project aimed at Apple identified a number of security problems that the company was apparently unaware of, but it didn't result in any serious worms or threats to Apple users. This month of PHP bugs might be a similar bust. On the other hand, Apple was able to push out a fix to these problems using the Mac OS Software Update feature. PHP has no such feature, and many ISPs run kind of elderly (and buggy) versions of the program. http://www.technologyreview.com/blog/garfinkel/17538/ http://www.technologyreview.com/blog/garfinkel/17538/

by nbpoole 16y ago

lkrubner 16y ago

That is exactly why WordPress needs to get serious about security. It's current attitude has been extremely slack. Their focus has been on releasing features that allow for a more pleasant user experience, rather than releasing features that enhance security. Above I compare the attitude of Microsoft to the attitude of Automattic. Justifiable criticism was aimed at Microsoft for promoting fun new user abilities, rather than security, in both DOS and Windows, for a long time. The same kind of criticism can be aimed at Automattic. What can they do? At the very least, they can automate the test that Siobhan Ambrose does in the above article linked to by this thread.

nbpoole 16y ago
Automate what test? Searching for calls to base64_encode? Five minutes after they do that, people will write their own base64-encoding functions. Security by blacklist is not security at all.
- lkrubner 16y ago
  My friend, your comment is remarkably besides the point. If we can agree that the WordPress team needs to focus on security, then we are basically in agreement. The details of how to do this can hopefully worked out by the WordPress team. They have certainly been given good advice over the years, much of which they have tended to ignore. Perhaps they will begin to listen. Given the scale of WordPress's success, we must hope they reform their ways. Ideally, at some point soon they will recognize some of the dangers that arise from using such an easy-to-set-up language as PHP, and they will recognize that they appeal to a largely non-technical audience, and they will start taking some responsibility for their choices, and their success.
  - henrikschroder 16y ago
    > My friend, your comment is remarkably besides the point. In what way? You don't seem to understand how useless black-list codescanning is, a competent malicious programmer will find ways around those in minutes. > Ideally, at some point soon they will recognize some of the dangers that arise from using such an easy-to-set-up language as PHP Dangers such as?
    - lkrubner 16y ago
      You write: "Dangers such as?" I find it hard to believe that you do not know the dangers. Please google "php sucks" or "php security" and you will discover thousands of articles that address what I referenced above when I wrote "the dangers that arise from using such an easy-to-set-up language as PHP". I also just posted a long comment up above in this thread, where I post quotes from several articles that have described the insecurity and disorganization that PHP makes so easy to achieve. You can view it here: http://news.ycombinator.com/item?id=2131602 http://news.ycombinator.com/item?id=2131602
      - lkrubner 16y ago
        Or, here is another: ------------ But PHP has more than a few security bugs: in many ways PHP is fundamentally flawed. The program, whose initials originally stood for Personal Home Page, was designed without much thought given to security. Many of the PHP features that make it really easy to write a Web application also make it really difficult to write one that's secure. All of this matters just now because Stefan Esser, the founder of the Hardened-PHP Project and the PHP Security Response Team (which he recently quit), has threatened to make March the "month of PHP bugs." By that, Esser means that he is going to be releasing a series of security bugs in March that show the world just how unsecure PHP actually is. What's driving Esser is both a desire to make PHP more secure and a good touch of anger and resentment at the current PHP developers who have taken many of his security patches and incorporated them into the program without giving Esser any credit. You can read more about his motivations in his blog entry and in the interview that he did with Security Focus. How will this affect users of the Web? Well, a recent "Month of Bugs" project aimed at Apple identified a number of security problems that the company was apparently unaware of, but it didn't result in any serious worms or threats to Apple users. This month of PHP bugs might be a similar bust. On the other hand, Apple was able to push out a fix to these problems using the Mac OS Software Update feature. PHP has no such feature, and many ISPs run kind of elderly (and buggy) versions of the program. http://www.technologyreview.com/blog/garfinkel/17538/ http://www.technologyreview.com/blog/garfinkel/17538/