3 ms·

It's not the point who the fault is, it's that if MacRumors/VBulletin grows the amount of users, they (jointly, the former, the latter) need to take into accoun

by ecesena 13y ago

It's not the point who the fault is, it's that if MacRumors/VBulletin grows the amount of users, they (jointly, the former, the latter) need to take into account security.

josteink 13y ago
So you are saying at a certain point they should security-audit the software they run on. At what point does that mean the source of the PHP forum-software? At what point does that mean the source of PHP itself? On what point does that become the source of the operating system PHP runs on? Add to this any other component involved which may or may not expose a security-risk, like MySQL, Email-servers, etc. I think while your attitude may be the right one, your statement is overly simplistic.
- fredsted 13y ago
  Making sure the password hashing mechanism is secure would be a good starting point...
Bluestrike2 13y ago
Absolutely. However, even though a site can and should take steps to mitigate risks, that doesn't really excuse the vendor for shipping software that doesn't even attempt to adhere to security best practices in the first place. Especially in the world of PHP software (forums in particular - vBulletin/phpBB/IPB/etc.) where it's marketed pretty much as an all-in-one solution. Easy to setup, easy to manage, easy to grow. It's the software equivalent of "just add water." But when you're marketing solutions like that to lay audiences, the onus is on you to at least try and account for the fact that most of your customers don't really have a clue what's going on. Especially at first, their customers are placing a great deal of trust in the software and the notion that the people behind it know what they're doing. What's a shame is that, if you've ever had the misfortune to dig into the source code for pretty much all of the PHP options out there, they really don't know what they're doing. To call it a mess would be an understatement of epic proportions.

by ecesena 13y ago

It's not the point who the fault is, it's that if MacRumors/VBulletin grows the amount of users, they (jointly, the former, the latter) need to take into account security.

josteink 13y ago

So you are saying at a certain point they should security-audit the software they run on. At what point does that mean the source of the PHP forum-software? At what point does that mean the source of PHP itself? On what point does that become the source of the operating system PHP runs on? Add to this any other component involved which may or may not expose a security-risk, like MySQL, Email-servers, etc. I think while your attitude may be the right one, your statement is overly simplistic.

fredsted 13y ago
Making sure the password hashing mechanism is secure would be a good starting point...

Bluestrike2 13y ago

Absolutely. However, even though a site can and should take steps to mitigate risks, that doesn't really excuse the vendor for shipping software that doesn't even attempt to adhere to security best practices in the first place. Especially in the world of PHP software (forums in particular - vBulletin/phpBB/IPB/etc.) where it's marketed pretty much as an all-in-one solution. Easy to setup, easy to manage, easy to grow. It's the software equivalent of "just add water." But when you're marketing solutions like that to lay audiences, the onus is on you to at least try and account for the fact that most of your customers don't really have a clue what's going on. Especially at first, their customers are placing a great deal of trust in the software and the notion that the people behind it know what they're doing. What's a shame is that, if you've ever had the misfortune to dig into the source code for pretty much all of the PHP options out there, they really don't know what they're doing. To call it a mess would be an understatement of epic proportions.