7 ms·

I am about as big (read: little) of a fan of PHP as the next guy but how in the hell are these problems inherent to PHP? If I were to run COBOL code from untrus

I am about as big (read: little) of a fan of PHP as the next guy but how in the hell are these problems inherent to PHP? If I were to run COBOL code from untrusted sources on my server you can forget about security.

lkrubner 16y ago
Why does WordPress allow people to run untrusted code? You write: "If I were to run COBOL code from untrusted sources on my server you can forget about security." That is why there should be a warning about untrusted code. Are you trying to let WordPress off the hook? Their attitude toward security has been horrible and they should be called out on it. I quote myself: What can they do? They can automate the test that Siobhan Ambrose does in the above article linked to by this thread. At the very least, WordPress can search a theme for Base64, so that when you try to activate the theme, you get a warning: "These templates contain Base64, which may be masking malicious code. Do you wish to proceed?" It doesn't matter if WordPress is written in PHP or COBOL, the team developing the software should make some attempt to address its many security flaws. Please consider the odd use of the word "disrespectful" in this paragraph: "It seems fundamentally disrespectful to users who are simply caught in the crossfire of a political power move their neither know or care about. PHP core has never shown any particular regard for its biggest apps, as evidenced by the above bug and others, so I’m not sure why we should go out of our way to promote their upgrade. PHP 6 sounds much more compelling." http://ma.tt/2007/07/on-php/#comment-422760 http://ma.tt/2007/07/on-php/#comment-422760 That is Matt Mullenweg. Please note that his statement can be turned on its head. I could write: "It seems fundamentally disrespectful to users to create software for them that has lots of fun features but no security."
- lkrubner 16y ago
  The downvoting on Hacker News sometimes seems wholly random. I am curious who would down vote this above comment of mine. I'm looking at each sentence and trying to think what people are disagreeing with. For instance: "That is why there should be a warning about untrusted code." What is the counter-argument, that WordPress should do nothing about the fact that the templates allow the execution of arbitrary code? "It doesn't matter if WordPress is written in PHP or COBOL, the team developing the software should make some attempt to address its many security flaws." What is the counter-argument, that WordPress has no responsibility for the security flaws in WordPress? Very curious.
  - pclark 16y ago
    The downvoting is probably due to your tone, I read your comments and agreed with you but god why do you write like that - why do you keep quoting people with "You write" style opening lines? it sets the tones of your comments off in the most horrible light.
- cosgroveb 16y ago
  There are two different walls of text here and I'm not going to respond to both but your argument has gone from "PHP sucks" to "Wordpress sucks." Basically my point is this: every bit of software you run on your web server is a security risk. You shouldn't run themes, or any code, really that come from sources you don't trust unless you audit it completely. I don't think the blame really lies with PHP or Wordpress in this case.
  - lkrubner 16y ago
    At no point did I say that PHP sucks. At no point did I say that WordPress sucks. I have suggested that the WordPress team is responsible for security risks in WordPress, regardless of what layer the risk may originate from. Again, I would quote the advice that Sam Ruby gave to Matt Mullenweg: "Yes, you can argue that they brought this upon themselves; but it is worth noting that at this point you are along for the ride. When I’m in similar circumstances, I tend to consider the karma implications of cursing the driver." That is good, and necessary, advice for any software project.
lkrubner 16y ago
Different programming environments enforce security to different degrees, with different defaults. I'll here post some of the many criticisms that have been aimed at PHP over the years: Andrew van der Stock writes: -------------- For some time, I’ve been worried about the direction of PHP. As many of you know, I helped write XMB Forum and now help write UltimaBB. XMB in particular is an old code base, and UltimaBB, a descendant from XMB. I’ve done a lot to protect that code base from attack, and luckily, we’ve been missed despite some doozy and silly security issues. After writing PHP forum software for three years now, I’ve come to the conclusion that it is basically impossible for normal programmers to write secure PHP code. It takes far too much effort. PHP needs a proper security architecture, and support for newbie programmers. PHP’s raison d’etre is that it is simple to pick up and make it do something useful. There needs to be a major push by the PHP Development team to take this advantage, and make it safe for the likely level of programmers – newbies. Newbies have zero chance of writing secure software unless their language is safe. Think about Logo for a minute. Logo can do some interesting things, but it is not a commercially useful language because it cannot do much. But it is an excellent teaching language. PHP is like Logo – it’s a simple and easy way to get into serious web development. It is possible to write large applications in PHP, so it is useful at that level. But it is inherently unsafe as it can do far, far more than Logo. There are so many ways to break PHP that it is impossible for even experienced security professionals like me to code in it securely all the time. There are nearly 4000 function calls, and many of them have unintended consequences or have been inappropriately extended by something else. http://www.greebo.net/2006/01/04/php-insecurity-failure-of-leadership/ http://www.greebo.net/2006/01/04/php-insecurity-failure-of-l... --------------- Tim Bray put together a collection of links regarding criticism of PHP: http://www.tbray.org/ongoing/When/200x/2006/02/17/PHP http://www.tbray.org/ongoing/When/200x/2006/02/17/PHP On that page, there is this from Dominic Mitchell: "I’m in 100% agreement with you about the whole PHP thing. Every time I’ve looked at PHP, I’ve been unable to find out how they use placeholders in code that talks to the database. Yes, every database adaptor provides a quote function, but nobody uses it (consistently). And people wonder why PHP code is always full of security holes. It’s a real shame, as I can see that there’s a lot to like in PHP. But it really needs to clean its act up to appeal to people coming from other programming languages, instead of just people coming from dreamweaver. I actually heard David Heinemeier Hansson (sp?) talking about rails the other day. One of the key points he made is that it should be easy to do the right thing. That’s why Rails hits a sweet spot for me. But when you look at PHP, yes, it’s easy to code, but it’s not easy to do the right thing. That’s where it falls down." The point that Hansson makes about Ruby is worth thinking about in the context of PHP security. Does PHP make it easy to write secure code? Does it help programmers do the right thing? The defaults in PHP, and the underlying assumptions of PHP, all tend in what direction? Of those links, Jonas Maurus's post is also well worth reading: http://maurus.net/resources/programming-languages/php/ http://maurus.net/resources/programming-languages/php/ Aristotle Pagaltzis sums up the underlying problem: "All of these flaws are interconnected; the morass is simply the result of the language being a templating system that grew too big for its breeches. I don’t believe the problems can be corrected in any sensible fashion; PHP will always be a templating system, however much it may be straining against its clothes. And let me tell you, it’s still a great templating system! If all you need is to write a web app that consists of two pages, running four queries over a five-table database, there is nothing that will get you up and running faster." http://plasmasturm.org/log/393/ http://plasmasturm.org/log/393/

lkrubner 16y ago

Why does WordPress allow people to run untrusted code? You write: "If I were to run COBOL code from untrusted sources on my server you can forget about security." That is why there should be a warning about untrusted code. Are you trying to let WordPress off the hook? Their attitude toward security has been horrible and they should be called out on it. I quote myself: What can they do? They can automate the test that Siobhan Ambrose does in the above article linked to by this thread. At the very least, WordPress can search a theme for Base64, so that when you try to activate the theme, you get a warning: "These templates contain Base64, which may be masking malicious code. Do you wish to proceed?" It doesn't matter if WordPress is written in PHP or COBOL, the team developing the software should make some attempt to address its many security flaws. Please consider the odd use of the word "disrespectful" in this paragraph: "It seems fundamentally disrespectful to users who are simply caught in the crossfire of a political power move their neither know or care about. PHP core has never shown any particular regard for its biggest apps, as evidenced by the above bug and others, so I’m not sure why we should go out of our way to promote their upgrade. PHP 6 sounds much more compelling." http://ma.tt/2007/07/on-php/#comment-422760 http://ma.tt/2007/07/on-php/#comment-422760 That is Matt Mullenweg. Please note that his statement can be turned on its head. I could write: "It seems fundamentally disrespectful to users to create software for them that has lots of fun features but no security."

lkrubner 16y ago
The downvoting on Hacker News sometimes seems wholly random. I am curious who would down vote this above comment of mine. I'm looking at each sentence and trying to think what people are disagreeing with. For instance: "That is why there should be a warning about untrusted code." What is the counter-argument, that WordPress should do nothing about the fact that the templates allow the execution of arbitrary code? "It doesn't matter if WordPress is written in PHP or COBOL, the team developing the software should make some attempt to address its many security flaws." What is the counter-argument, that WordPress has no responsibility for the security flaws in WordPress? Very curious.
- pclark 16y ago
  The downvoting is probably due to your tone, I read your comments and agreed with you but god why do you write like that - why do you keep quoting people with "You write" style opening lines? it sets the tones of your comments off in the most horrible light.
cosgroveb 16y ago
There are two different walls of text here and I'm not going to respond to both but your argument has gone from "PHP sucks" to "Wordpress sucks." Basically my point is this: every bit of software you run on your web server is a security risk. You shouldn't run themes, or any code, really that come from sources you don't trust unless you audit it completely. I don't think the blame really lies with PHP or Wordpress in this case.
- lkrubner 16y ago
  At no point did I say that PHP sucks. At no point did I say that WordPress sucks. I have suggested that the WordPress team is responsible for security risks in WordPress, regardless of what layer the risk may originate from. Again, I would quote the advice that Sam Ruby gave to Matt Mullenweg: "Yes, you can argue that they brought this upon themselves; but it is worth noting that at this point you are along for the ride. When I’m in similar circumstances, I tend to consider the karma implications of cursing the driver." That is good, and necessary, advice for any software project.

lkrubner 16y ago

Different programming environments enforce security to different degrees, with different defaults. I'll here post some of the many criticisms that have been aimed at PHP over the years: Andrew van der Stock writes: -------------- For some time, I’ve been worried about the direction of PHP. As many of you know, I helped write XMB Forum and now help write UltimaBB. XMB in particular is an old code base, and UltimaBB, a descendant from XMB. I’ve done a lot to protect that code base from attack, and luckily, we’ve been missed despite some doozy and silly security issues. After writing PHP forum software for three years now, I’ve come to the conclusion that it is basically impossible for normal programmers to write secure PHP code. It takes far too much effort. PHP needs a proper security architecture, and support for newbie programmers. PHP’s raison d’etre is that it is simple to pick up and make it do something useful. There needs to be a major push by the PHP Development team to take this advantage, and make it safe for the likely level of programmers – newbies. Newbies have zero chance of writing secure software unless their language is safe. Think about Logo for a minute. Logo can do some interesting things, but it is not a commercially useful language because it cannot do much. But it is an excellent teaching language. PHP is like Logo – it’s a simple and easy way to get into serious web development. It is possible to write large applications in PHP, so it is useful at that level. But it is inherently unsafe as it can do far, far more than Logo. There are so many ways to break PHP that it is impossible for even experienced security professionals like me to code in it securely all the time. There are nearly 4000 function calls, and many of them have unintended consequences or have been inappropriately extended by something else. http://www.greebo.net/2006/01/04/php-insecurity-failure-of-leadership/ http://www.greebo.net/2006/01/04/php-insecurity-failure-of-l... --------------- Tim Bray put together a collection of links regarding criticism of PHP: http://www.tbray.org/ongoing/When/200x/2006/02/17/PHP http://www.tbray.org/ongoing/When/200x/2006/02/17/PHP On that page, there is this from Dominic Mitchell: "I’m in 100% agreement with you about the whole PHP thing. Every time I’ve looked at PHP, I’ve been unable to find out how they use placeholders in code that talks to the database. Yes, every database adaptor provides a quote function, but nobody uses it (consistently). And people wonder why PHP code is always full of security holes. It’s a real shame, as I can see that there’s a lot to like in PHP. But it really needs to clean its act up to appeal to people coming from other programming languages, instead of just people coming from dreamweaver. I actually heard David Heinemeier Hansson (sp?) talking about rails the other day. One of the key points he made is that it should be easy to do the right thing. That’s why Rails hits a sweet spot for me. But when you look at PHP, yes, it’s easy to code, but it’s not easy to do the right thing. That’s where it falls down." The point that Hansson makes about Ruby is worth thinking about in the context of PHP security. Does PHP make it easy to write secure code? Does it help programmers do the right thing? The defaults in PHP, and the underlying assumptions of PHP, all tend in what direction? Of those links, Jonas Maurus's post is also well worth reading: http://maurus.net/resources/programming-languages/php/ http://maurus.net/resources/programming-languages/php/ Aristotle Pagaltzis sums up the underlying problem: "All of these flaws are interconnected; the morass is simply the result of the language being a templating system that grew too big for its breeches. I don’t believe the problems can be corrected in any sensible fashion; PHP will always be a templating system, however much it may be straining against its clothes. And let me tell you, it’s still a great templating system! If all you need is to write a web app that consists of two pages, running four queries over a five-table database, there is nothing that will get you up and running faster." http://plasmasturm.org/log/393/ http://plasmasturm.org/log/393/