6 ms·

Blog appears to have some issues: "Your PHP installation appears to be missing the MySQL extension which is required by WordPress."

by id 12y ago

themodelplumber 12y ago
Gutsy move, posting to HN about a security vulnerability at Amazon. And using WordPress to do it. I'll bet this guy loves playing on cliffs, too.
- joshfraser 12y ago
  I would hope my blog would be easier to hack than Amazon. Playing on cliffs and rock climbing is fun, btw. :)
- rabino 12y ago
  Why? You have a lot of ways to hack a WordPress site?
  - deleted 12y ago
    [deleted]
  - daeken 12y ago
    > <azonenberg> wordpress is an unauthenticated remote shell that, as a useful side feature, also contains a blog That's an old joke and obviously an exaggeration, but it's not horribly far off. Wordpress instances fall to attack constantly, due to a combination of bugs in the base application itself (not terribly common) and extensions (not just common -- CONSTANT). In terms of breakability, I would rank Wordpress in the top 1% of applications without a second thought.
    - georgestephanis 12y ago
      If you believe you're aware of any security issues with WordPress core itself, Automattic is running a Bug Bounty program over on HackerOne here: https://hackerone.com/automattic/ https://hackerone.com/automattic/ -- responsible disclosure, bug bounties, and making the web a safer place is awesome.
      - nomedeplume 12y ago
        You really think some piddling Automattic bounty is more valuable than a WordPress 0day?!?!?!?!? (Conscious punctuation.) I'm at a loss for words, scaredy-cat.
        notfoss 12y ago
        So you are implying that there are no honest people out there, and on top of that everyone that finds a vulnerability has the guts and resources to make money off a 0day bug?
        shiven 12y ago
        What's so hard in making money off 0days? Especially in this day and age of SilkRoute clones and Cryptocurrencies. I was under the impression that a big reason why 0day exploits are not popping up all over is because the folks who discover them can now sell them (for way more than any bounty program), whereas earlier the only way to monetize was to use them as advertisement for selling your skills. Instant payment vs Contractual jobs. I'd say now the 0day vulns end up in the hands of professionals (criminal networks/state actors) rather than script kiddies.
        judk 12y ago
        More than one person can rediscover an exploit. Paying all of them gets expensive
joshfraser 12y ago
Sorry about that. I tried to push the POC code to my blog and forgot that Heroku doesn't like the version of Wordpress I'm running. Should be back up now.

Blog appears to have some issues: "Your PHP installation appears to be missing the MySQL extension which is required by WordPress."

by id 12y ago

Blog appears to have some issues: "Your PHP installation appears to be missing the MySQL extension which is required by WordPress."

themodelplumber 12y ago

Gutsy move, posting to HN about a security vulnerability at Amazon. And using WordPress to do it. I'll bet this guy loves playing on cliffs, too.

joshfraser 12y ago
I would hope my blog would be easier to hack than Amazon. Playing on cliffs and rock climbing is fun, btw. :)
rabino 12y ago
Why? You have a lot of ways to hack a WordPress site?
- deleted 12y ago
  [deleted]
- daeken 12y ago
  > <azonenberg> wordpress is an unauthenticated remote shell that, as a useful side feature, also contains a blog That's an old joke and obviously an exaggeration, but it's not horribly far off. Wordpress instances fall to attack constantly, due to a combination of bugs in the base application itself (not terribly common) and extensions (not just common -- CONSTANT). In terms of breakability, I would rank Wordpress in the top 1% of applications without a second thought.
  - georgestephanis 12y ago
    If you believe you're aware of any security issues with WordPress core itself, Automattic is running a Bug Bounty program over on HackerOne here: https://hackerone.com/automattic/ https://hackerone.com/automattic/ -- responsible disclosure, bug bounties, and making the web a safer place is awesome.
    - nomedeplume 12y ago
      You really think some piddling Automattic bounty is more valuable than a WordPress 0day?!?!?!?!? (Conscious punctuation.) I'm at a loss for words, scaredy-cat.
      - notfoss 12y ago
        So you are implying that there are no honest people out there, and on top of that everyone that finds a vulnerability has the guts and resources to make money off a 0day bug?
        shiven 12y ago
        What's so hard in making money off 0days? Especially in this day and age of SilkRoute clones and Cryptocurrencies. I was under the impression that a big reason why 0day exploits are not popping up all over is because the folks who discover them can now sell them (for way more than any bounty program), whereas earlier the only way to monetize was to use them as advertisement for selling your skills. Instant payment vs Contractual jobs. I'd say now the 0day vulns end up in the hands of professionals (criminal networks/state actors) rather than script kiddies.
        judk 12y ago
        More than one person can rediscover an exploit. Paying all of them gets expensive

joshfraser 12y ago

Sorry about that. I tried to push the POC code to my blog and forgot that Heroku doesn't like the version of Wordpress I'm running. Should be back up now.