5 ms·

Just playing devil's advocate, but isn't this true with many CMSs? Most implement "users" (and or groups) either in-house or using the underlying OS, and when i

Just playing devil's advocate, but isn't this true with many CMSs? Most implement "users" (and or groups) either in-house or using the underlying OS, and when it is the underlying OS the CMS needs access to all of the user's files anyway to make cooperation and interoperability work, essentially placing a big bullseye on the CMS system itself.

mariocesar 12y ago
It's true and is the reason why so many PHP powered CMS are so insecure, how many times do you hear about a new wordpress exploit?
- UnoriginalGuy 12y ago
  It really has nothing to do with PHP. Changing the language or framework wouldn't inherently change the design. e.g. http://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-11116/Microsoft-Sharepoint-Server.html http://www.cvedetails.com/vulnerability-list/vendor_id-26/pr...
  - tankenmate 12y ago
    Having said that PHP does make it very hard to run each interpreter process as the user it is doing work on behalf of. Some of the best systems out there run each user's process under it's own uid:gid (or equivalent), and each user has their own filespace and/or database. Obviously this pushes the separation issues down to the OS kernel rather than in the app, but most widely used OS kernels get at least an order of magnitude more, most of the time several orders more, testing for these user separation security features. NIH, re-inventing the wheel and all that.
- drzaiusapelord 12y ago
  how many times do you hear about a new linux kernel exploit? Pretty much everything is insecure. Writing things in not-php isn't the magical fix you seem to think it is.
  - moe 12y ago
    What an absurd comparison... The linux kernel has 16 million lines of code, Wordpress has 300k. Yet Wordpress[1] has had nearly as many security vulnerabilities as the kernel[2]; 194 vs 257 exploits. Wordpress is one of the most exploited software packages ever created. It is the textbook example of bad programming. Just mentioning the kernel when talking about Wordpress is pretty ridiculous. [1] http://www.cvedetails.com/vulnerability-list/vendor_id-2337/product_id-4096/Wordpress-Wordpress.html http://www.cvedetails.com/vulnerability-list/vendor_id-2337/... [2] http://www.cvedetails.com/vulnerability-list/vendor_id-33/product_id-47/cvssscoremin-7/cvssscoremax-7.99/Linux-Linux-Kernel.html http://www.cvedetails.com/vulnerability-list/vendor_id-33/pr...
    - jordanlev 12y ago
      I am no fan of wordpress, and I agree that it is a textbook example of bad programming... but it is also a textbook example of good community management and success at empowering non-programmers to have their own web presence. And I believe that the amount of exploits has as much to do (if not moreso) with its sheer popularity as it does with the code.
    - maratd 12y ago
      > Wordpress is one of the most exploited software packages ever created. Hyperbole much? It's one of the most popular software packages installed on the web. It's not surprising it has a lot of eyes on it.
      - moe 12y ago
        This has nothing to do with eyes. Dozens of other packages have a much larger install base than Wordpress. Wordpress has 32(!) CVE's tagged with "Exec Code" (remote code execution) alone. The last one a mere 6 months old. If you know another project that comes even remotely close to that then I'd be genuinely curious which one that would be?
        maratd 12y ago
zimbatm 12y ago
The difference is that OwnCloud is marketed as an operating system and is aimed at holding all the user's personal information. Users who aren't necessarily knowledgeable enough to distinguish trusted and untrusted "applications". A CMS is usually used by a company and has different threat scenarios. Usually only sysadmins configure and install extensions.

mariocesar 12y ago

It's true and is the reason why so many PHP powered CMS are so insecure, how many times do you hear about a new wordpress exploit?

UnoriginalGuy 12y ago
It really has nothing to do with PHP. Changing the language or framework wouldn't inherently change the design. e.g. http://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-11116/Microsoft-Sharepoint-Server.html http://www.cvedetails.com/vulnerability-list/vendor_id-26/pr...
- tankenmate 12y ago
  Having said that PHP does make it very hard to run each interpreter process as the user it is doing work on behalf of. Some of the best systems out there run each user's process under it's own uid:gid (or equivalent), and each user has their own filespace and/or database. Obviously this pushes the separation issues down to the OS kernel rather than in the app, but most widely used OS kernels get at least an order of magnitude more, most of the time several orders more, testing for these user separation security features. NIH, re-inventing the wheel and all that.
drzaiusapelord 12y ago
how many times do you hear about a new linux kernel exploit? Pretty much everything is insecure. Writing things in not-php isn't the magical fix you seem to think it is.
- moe 12y ago
  What an absurd comparison... The linux kernel has 16 million lines of code, Wordpress has 300k. Yet Wordpress[1] has had nearly as many security vulnerabilities as the kernel[2]; 194 vs 257 exploits. Wordpress is one of the most exploited software packages ever created. It is the textbook example of bad programming. Just mentioning the kernel when talking about Wordpress is pretty ridiculous. [1] http://www.cvedetails.com/vulnerability-list/vendor_id-2337/product_id-4096/Wordpress-Wordpress.html http://www.cvedetails.com/vulnerability-list/vendor_id-2337/... [2] http://www.cvedetails.com/vulnerability-list/vendor_id-33/product_id-47/cvssscoremin-7/cvssscoremax-7.99/Linux-Linux-Kernel.html http://www.cvedetails.com/vulnerability-list/vendor_id-33/pr...
  - jordanlev 12y ago
    I am no fan of wordpress, and I agree that it is a textbook example of bad programming... but it is also a textbook example of good community management and success at empowering non-programmers to have their own web presence. And I believe that the amount of exploits has as much to do (if not moreso) with its sheer popularity as it does with the code.
  - maratd 12y ago
    > Wordpress is one of the most exploited software packages ever created. Hyperbole much? It's one of the most popular software packages installed on the web. It's not surprising it has a lot of eyes on it.
    - moe 12y ago
      This has nothing to do with eyes. Dozens of other packages have a much larger install base than Wordpress. Wordpress has 32(!) CVE's tagged with "Exec Code" (remote code execution) alone. The last one a mere 6 months old. If you know another project that comes even remotely close to that then I'd be genuinely curious which one that would be?
      - maratd 12y ago

zimbatm 12y ago

The difference is that OwnCloud is marketed as an operating system and is aimed at holding all the user's personal information. Users who aren't necessarily knowledgeable enough to distinguish trusted and untrusted "applications". A CMS is usually used by a company and has different threat scenarios. Usually only sysadmins configure and install extensions.