6 ms·
It does seem that more serious maintenance and auditing of these providers is needed. Looking at this thread on reddit https://old.reddit.com/r/msp/comments/ocg
by raesene9 5y ago
It does seem that more serious maintenance and auditing of these providers is needed. Looking at this thread on reddit https://old.reddit.com/r/msp/comments/ocggbv/crticial_ransomware_incident_in_progress/ https://old.reddit.com/r/msp/comments/ocggbv/crticial_ransom... which is by a company looking into the incident and how it happened, it seems that it was exploited vulnerabilities in Classic ASP files used as part of the solution.
Having classic ASP pages hosted on a production system in 2021 seems like a pretty strong indication of a lack of codebase maintenance and auditing.
- giardini 5y agoraesene9:5 says >"Having classic ASP pages hosted on a production system in 2021 seems like a pretty strong indication of a lack of codebase maintenance and auditing."< AFAIK classic ASP pages can be as secure as those in any other framework. The vulnerabilities (most commonly SQL injection) are known and are addressable. I know it chafes at some (Microsoft marketers esp.?) that ASP pages are still around. But classic ASP is yet another example of that old adage "If it ain't broke, don't fix it!" I watched one organization assign an entire division of programmers to develop a moderately-sized ASP.NET application: they went through orientation and training in ASP.NET and then planned, designed, coded and rolled out ...nothing! After two years there was literally nothing! A perceptive manager in another division approached his sole ASP developer and asked if she could write some ASP code to "demo" that same project. She looked at the specifications and then quietly wrote an entire system! Weeks later, when the department heads saw her "demo", they thought the ASP.NET developers had completed it. Imagine their surprise to find that what they were looking at was done, not by the ASP.NET group funded millions of dollars but by someone in another division: a single focused classic ASP developer quietly working downstairs. Nonetheless IIRC ASP pages reach end-of-life support by Microsoft in 2025 so it might make sense to migrate. But b/c classic ASP was written in a manner consistent with early web standards (CGI/APACHE) migration of classic ASP to one of the various classic ASP-like frameworks in PHP, Perl, Ruby et al would likely be easier, faster and cheaper. Migration would be mostly translation and much, if not all, could be automated. In contrast, moving classic ASP to ASP.NET would be more fraught with problems. The underlying models of the WWW are inconsistent.
- raesene9 5y agoThe thing about Classic ASP is that it has no in-built protections and the individual developer has to code all defence, which is not great. Also, how many classic ASP developers are there now , to add new protections for new issues... And if you look at the linked thread, it doesn't seem like they've done a great job of maintenance...
- giardini 5y agoraesene9 says >"The thing about Classic ASP is that it has no in-built protections and the individual developer has to code all defence,,,"< Yes, it is just like PHP or Perl or Ruby with the CGI specification. raesene9 says >" how many classic ASP developers are there now ..."< Good question! But IMO a web developer could learn classic ASP in a single day!8-)) raesene9 says >"the individual developer has to code all defence,< Yes, just like PHP or Perl or Python.
- raesene9 5y agoSure so they learn classic ASP in a day, now they have to code their own custom routines for XSS protection, SQLi Protection, SSRF protection etc etc etc or.... they could move the application to a supported platform with a wider developer base and in-built protections against common web application security attacks. There is a reason why most web app developers do not hand code their entire stacks. For example why ruby web developers use rails. Web app. sec. is a a relatively complex field to get right, full of edge cases. Having each and every web app development team take the time to understand all those cases and edges probably isn't the best use of scarce developer resources.
- Shacklz 5y ago> and then wrote an entire system! Yes yes. And this was of course very maintainable, up to todays standards, easy to onboard new hires in, not falling apart in edge cases that weren't part of the demo, code that was audited by multiple developers, it didn't make any shortcuts in terms of security, etc. etc. etc. That some business guys are amazed by the "lone wolf dev skills" might be explainable, but on HN we should know better. Yes, there are devs that get a ton done irrelevant of framework, but "getting things done" (in terms of business requirements) is only part of the story.
- citrin_ru 5y agoOld != bad. Old and well maintained software can be reliable and secure, it just rate to encounter it. Maintenance is underappreciated. People don't get rises and promotions for successful maintenance of an old system. But they get it for new projects even if this project is rewriting of an old system in a new language/framework (even if a rewrite introduces new bugs, vulnerabilities and drops some old features). So if an organization has money to spare, the software will be re-written every several years to flow the fashion and if doesn't have money security will suffer too.
- cerved 5y agoit's bad if it's running on a deprecated runtime that's no longer being patched for security
- citrin_ru 5y agoIf the runtime is no longer maintained then it is of course it is a problem (I'm from the Unix world and don't know if classic ASP is still supported by the vendor). We cannot say that a system as a whole is well maintained if it's dependencies are not.