5 ms·

Kinda scary how bad master.php.net was. - md5 passwords more or less - “...running very old code on a very old operating system...” - no parameterized querie

• rgovostes 6y ago
  Sounds like the golden age of PHP.
  • o-__-o 6y ago
    I’ve heard the term dogfooding before but this is ridiculous
    • Cthulhu_ 6y ago
      They dogfooded, past tense. But nobody wants to work with old PHP code - which I guess is part of the dogfooding in this case? idk
• ocdtrekkie 6y ago
  I'm assuming PHP is a victim of it's success here: Widely used systems feel incredible pushback to breakage of existing functionality when "everything is working". In this case, fixing the password security would've required breaking everyone's ability to commit to the PHP codebase, so it was not done. This is pretty much... all large scale enterprise IT: Everyone's good with security improvements until it interrupts a business unit, and then someone up the chain decides it isn't worth the disruption to deal with a hypothetical security risk.
  • striking 6y ago
    > fixing the password security would've required breaking everyone's ability to commit to the PHP codebase The parameterized queries could have been fixed, though, right? And you can progressively update people's passwords to a different algorithm as they log back in, and warn them that in six months their password will need to be reset if they haven't logged in.
    • blowski 6y ago
      And if someone hasn’t logged in for 6 months, their account should probably deactivated anyway. But, yeah, the comment above is right about enterprise IT. I’ve sat in on meetings where 2FA was ruled out as being too unusable by the marketing team, who said quarterly password rotations were a “good compromise”. They just want to be seen to be doing something about security, and pick fixes that don’t involve much cost to anybody, but also tend to provide little value.
  • taspeotis 6y ago
    > fixing the password security would've required breaking everyone's ability to commit to the PHP codebase Can’t you have a scheme that is like bcrypt(md5(password)) and since you already have md5(password) in the database you can migrate to bcrypt?
    • drrotmos 6y ago
      Not if you need to support HTTP Digest authentication.
      • merb 6y ago
        well http digest auth is stupid. it looks more secure because the password is not sent unencrypted over the wire. however it still is bad. kerberos or even basic auth (because the password can be checked on the server against a real algorithm) would've made this impossible.
  • pbowyer 6y ago
    PHP is a victim of a lack of core contributors and a reputation as a toxic environment if you get involved. We think of Python as severely under resourced (2 FTE devs on the language IIRC?) but PHP has less. PHP's ethos means there's no FAANG sponsorship; companies like Jetbrains do sponsor core developers but the developer of the de facto debugger, unit testing framework and package manager/repository all fundraise for their own work. It's nice in the 00's-era hacker ethos, but for a language so widely used it's deeply under-resourced. And that's one reason why the infrastructure is old and creaking. As recently as 2020 there was pushback by php-internals' members to using GitHub because it wasn't open/their own infrastructure. This incident has been a catalyst for change, and there is much more change needed.
    • exikyut 6y ago
      Any environment that regards marketing as proscriptive instead of subscriptive is already insecure anyway :/
• tyingq 6y ago
  "The master.php.net system, which is used for authentication and various management tasks, was running very old code on a very old operating system / PHP version" Yeah, that's not great.