4 ms·

I note a lot of downvotes for comments generally blaming PHP for this hack. That is sad and reflects a significant failure to grasp history. PHP has been a sec

I note a lot of downvotes for comments generally blaming PHP for this hack. That is sad and reflects a significant failure to grasp history. PHP has been a security problem from day 1. Wordpress has only increased the scope of attack surfaces, as well as introduced a popular application which is itself susceptible to compromise. I've seen arguments that PHP is the root cause of those application vulnerabilities, but I tend to aim even lower and point to application developers who use PHP. Unless your core app is in PHP and all your efforts go to securing that thing, there is no justification for allowing PHP on a production network. It is not a trivial thing to secure.

sanswork 12y ago
That's because blaming the language for this hack is silly and simple minded. php had nothing to do with the multitude of failures in basic security practices that happened here.
- spacemanmatt 12y ago
  No, it's not, because PHP is hack on top of hack, and forces programmers into a persistent defensive posture. This is what happens when you force developers and sysadmins into defensive posture.
  - sanswork 12y ago
    Which language doesn't require a programmer to be in a persistent defensive posture when dealing with bad actors?
    - spacemanmatt 12y ago
      Fine, you can always find a defense, but my basic point is that PHP forces you to find them all. Many languages do not threaten to undermine very reasonable code in entirely unreasonable ways. I thought PHP would be great, when I was a junior sysadmin with programming aspirations and that CGI stuff looked like a hot mess. Today, I recognize it as a fractal of bad design. http://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ http://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/
      - sanswork 12y ago
        I don't understand what you're trying to say here "you can always find a defense, but my basic point is that PHP forces you to find them all.". What features of other languages make them inherently more secure than php? Do you know of any that aren't admin issues? Yourself and the other person in this thread loudly claiming php is the reason for this are both doing the same thing. Handwaving around bad language design without pointing out anything concrete about security. Do you know the answer to the question or are you just parroting?

sanswork 12y ago

That's because blaming the language for this hack is silly and simple minded. php had nothing to do with the multitude of failures in basic security practices that happened here.

spacemanmatt 12y ago
No, it's not, because PHP is hack on top of hack, and forces programmers into a persistent defensive posture. This is what happens when you force developers and sysadmins into defensive posture.
- sanswork 12y ago
  Which language doesn't require a programmer to be in a persistent defensive posture when dealing with bad actors?
  - spacemanmatt 12y ago
    Fine, you can always find a defense, but my basic point is that PHP forces you to find them all. Many languages do not threaten to undermine very reasonable code in entirely unreasonable ways. I thought PHP would be great, when I was a junior sysadmin with programming aspirations and that CGI stuff looked like a hot mess. Today, I recognize it as a fractal of bad design. http://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ http://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/
    - sanswork 12y ago
      I don't understand what you're trying to say here "you can always find a defense, but my basic point is that PHP forces you to find them all.". What features of other languages make them inherently more secure than php? Do you know of any that aren't admin issues? Yourself and the other person in this thread loudly claiming php is the reason for this are both doing the same thing. Handwaving around bad language design without pointing out anything concrete about security. Do you know the answer to the question or are you just parroting?