4 ms·
> sometimes see that their front page has outdated PHP, as in 5.3 old. EOL for 11 months. That really bothers me. How can I rely on their security when their fr
by noja 11y ago
> sometimes see that their front page has outdated PHP, as in 5.3 old. EOL for 11 months. That really bothers me. How can I rely on their security when their frontpage isn’t even up-to-date.
Errr... are you determining that the software is vulnerable through the version number alone? That won't work, some vendors backport security patches.
- dolfje 11y agoThat is true, there are many manufacturers that keep up to date and add their own patches. Though for a frontpage, I don't think that is true. It is much easier to update your software, than going through all patches, keeping up to date. So for clients I believe you can maintain 5.3, but for just your own frontpage? I doubt it... Also I would believe that having PHP 5.3 is an unique selling point, so they would advert that unique selling point on their website. (What wasn't done)
- kijin 11y ago> It is much easier to update your software, than going through all patches If you're on CentOS, as a lot of web hosts are, all you need to do is `yum update` from time to time.
- dolfje 11y agoYes and then you are using a packaged version. But those hosters don't use a packaged version. So yum update doesn't work. I would definitely advice everybody to use a package manager, because that helps you keep everything secure ;)
- daenney 11y agoHow do you know that they don't? You state it, but you offer no proof to support that.
- jaysh 11y agoThe dominant control panel on the web is cPanel, which offers no ability to used packaged versions of PHP, Apache, or any of its extensions. They have a special interface used to pull in everything (sources, and even custom patches from cPanel) and compile it on the server and install it directly (configuring PHP, Apache, and any of the chosen extensions) automatically.
- dolfje 11y agoBecause PHP au contrary to Apache returns the full packaged version (so PHP packaged version are easier to check out). Also having e.g. OpenSSH ubuntu version strongly suggest you are using PHP ubuntu version. In that way we could cross out some of the packaged versions.
- qewrffewqwfqew 11y agoA version that has been end-of-lifed and is superseded by three minor releases is a pretty strong indication. The amount of work involved in backporting patches is likely to be significantly more than migrating to a supported version which receives timely patches.
- noja 11y agoNo it's not a strong indication at all. Red Hat does the backporting work for you. You choose that platform if you want your software you spent man-decades writing to keep working for 10-13 years.
- dolfje 11y agoIt is a strong indication, because we are talking about non-packaged versions. PHP 5.3 is still maintained in Ubuntu, so those hosters aren't on the blame list. Only if PHP 5.3 / 5.2 / 5.1 is used without package manager.
- noja 11y agoIt might be a strong enough indication to investigate further, but it is not a strong enough indication to out a company. You need to actively test the vulnerability to be sure (or relabel your page with a heavy disclaimer).