5 ms·

I think it's safe to say that 100% of PHP installs have a security vulnerability of some kind, though that doesn't mean the vulnerabilities are known or exploit

I think it's safe to say that 100% of PHP installs have a security vulnerability of some kind, though that doesn't mean the vulnerabilities are known or exploitable.

Osiris 12y ago
I think it's safe to say that 100% of all software and hardware have a security vulnerability of some kind, though that doesn't mean the vulnerabilities are known or exploitable.
- eyeinthepyramid 12y ago
  Exactly. Being on the bleeding edge doesn't mean that people aren't vulnerable, it just means that people don't know how vulnerable they are.
  - tracker1 12y ago
    Which is precisely why I use carrier pigeons from my secure locations to use the internet... All disks in and out are block-level scanned and analysed before loaded at the application level, and USB ports are hot glued closed, along with peripherals hot-glued in place.
  - callum85 12y ago
    But it does make you much less vulnerable, because you're only vulnerable to the tiny proportion of attackers who have discovered a zero day exploit.
    - r0s 12y ago
      That's true of older versions with security updates too.
smsm42 12y ago
This is as useful as coming to a hospital and telling the doctors "Why waste your time, guys? Everybody is going to die anyway!". Close to 100% of software is faulty and vulnerable, yet there's a difference between running software with known published issues and running software without them.
- doctorshady 12y ago
  There aren't several new diseases that people need to be inoculated against every month.
  - smsm42 12y ago
    Unfortunately, nobody has invented yet a security vaccine. If you do, you can only regret they don't give Nobel prizes for computer stuff, but Turing award would be pretty much in the pocket for you.
- TylerE 12y ago
  However, to use your analogy, ceasing to use PHP is like stopping smoking and dropping 50lbs. Sure, it'll still happen eventually, but the expectancy curve is a lot flatter.
  - smsm42 12y ago
    Except that it's not. Unless you also cease to use bash, SSL, ssh, OpenVPN, iOS, Java... well, with this list it's better stay away from computers altogether. Good, healthy life as a goat herder somewhere up in the mountains. The myth that PHP has some special bad security profile is completely baseless. It is true that there's a lot of insecure software written in PHP, but the reason has nothing to do with security of PHP as a platform, but rather with its low learning curve, which makes it popular among the same people that make security mistakes - the beginners. They don't make insecure software in Haskell not because Haskell is so secure that you can't write insecure software in it, but because they can't write any software in Haskell at all. Dropping PHP in this case is a cargo cult - you do not improve your security situation by just mimicking people that made better security decisions in aspects that have nothing to do with security. It's like stopping eating bananas because your neighbor slipped on a banana peel and broke his neck, all while keeping smoking and eating junk food. Replacing negligible risk with another negligible risk while keeping very risky habits would not reduce your overall risk.

I think it's safe to say that 100% of PHP installs have a security vulnerability of some kind, though that doesn't mean the vulnerabilities are known or exploitable.

Osiris 12y ago

I think it's safe to say that 100% of all software and hardware have a security vulnerability of some kind, though that doesn't mean the vulnerabilities are known or exploitable.

eyeinthepyramid 12y ago
Exactly. Being on the bleeding edge doesn't mean that people aren't vulnerable, it just means that people don't know how vulnerable they are.
- tracker1 12y ago
  Which is precisely why I use carrier pigeons from my secure locations to use the internet... All disks in and out are block-level scanned and analysed before loaded at the application level, and USB ports are hot glued closed, along with peripherals hot-glued in place.
- callum85 12y ago
  But it does make you much less vulnerable, because you're only vulnerable to the tiny proportion of attackers who have discovered a zero day exploit.
  - r0s 12y ago
    That's true of older versions with security updates too.

smsm42 12y ago

This is as useful as coming to a hospital and telling the doctors "Why waste your time, guys? Everybody is going to die anyway!". Close to 100% of software is faulty and vulnerable, yet there's a difference between running software with known published issues and running software without them.

doctorshady 12y ago
There aren't several new diseases that people need to be inoculated against every month.
- smsm42 12y ago
  Unfortunately, nobody has invented yet a security vaccine. If you do, you can only regret they don't give Nobel prizes for computer stuff, but Turing award would be pretty much in the pocket for you.
TylerE 12y ago
However, to use your analogy, ceasing to use PHP is like stopping smoking and dropping 50lbs. Sure, it'll still happen eventually, but the expectancy curve is a lot flatter.
- smsm42 12y ago
  Except that it's not. Unless you also cease to use bash, SSL, ssh, OpenVPN, iOS, Java... well, with this list it's better stay away from computers altogether. Good, healthy life as a goat herder somewhere up in the mountains. The myth that PHP has some special bad security profile is completely baseless. It is true that there's a lot of insecure software written in PHP, but the reason has nothing to do with security of PHP as a platform, but rather with its low learning curve, which makes it popular among the same people that make security mistakes - the beginners. They don't make insecure software in Haskell not because Haskell is so secure that you can't write insecure software in it, but because they can't write any software in Haskell at all. Dropping PHP in this case is a cargo cult - you do not improve your security situation by just mimicking people that made better security decisions in aspects that have nothing to do with security. It's like stopping eating bananas because your neighbor slipped on a banana peel and broke his neck, all while keeping smoking and eating junk food. Replacing negligible risk with another negligible risk while keeping very risky habits would not reduce your overall risk.