nbpoole

35 ms·

301.
by nbpoole 16y ago
I think you're missing the point of the analogy. Check out http://en.wikipedia.org/w/index.php?title=Victim_blaming&#38...
302.
by nbpoole 16y ago
If it's what was on the PHP Fog Sucks website, it worked something like this (I may be misremembering a step): 1. Use the post-deploy hook to chmod /home/ubuntu/.ssh so that it could be written to. 2. Upload a PHP shell, use it to write y
303.
by nbpoole 16y ago
" PHPFog built a castle out of sand and you're upset that a wave came and demolished it. " Your analogy is slightly off. A wave is an act of nature: this is more along the lines of a jealous kid who knocks down someone else's sandcastle bec
304.
by nbpoole 16y ago
Personally, I'm a fan of some of his post-hoc justification: " Following this, I took a hold of their Twitter account and posted a couple of bits to draw attention to the fact. This did two things. One, it showed people the system was insec
305.
by nbpoole 16y ago
And here's Elliot's "official statement": http://elliotspeck.com/phpfog.html And for anyone who missed it, here's what Elliot posted in the previous HN discussion about the phpFog breach: http://news.ycombinator.com/item?id=2346161
306.
by nbpoole 16y ago
Thanks for the followup :-) Edit: For anyone else who's curious, here's what I'm seeing from the Google cache: <meta name="generator" content="DokuWiki Release 2008-05-05" /> There appear to have been three major releases o
307.
by nbpoole 16y ago
I'm sorry. I wasn't attempting to bait you: I've been following this story since Friday, so I only skimmed this article the first time through. When I originally replied to you, I didn't know why you thought it took days. But you're right,
308.
by nbpoole 16y ago
Friday: "We are aware of a possible compromise of PHP.NET server(s) and a potential PHP source backdoor. "wiki.php.net" was taken offline" | https://twitter.com/#!/VUPEN/status/48696644975337472 Saturday: "php.net security notice" | http
309.
by nbpoole 16y ago
Edit: The linked article talks about people spending the past few days reviewing for code modifications. Based on other sources (VUPEN Twitter, PHP.net), it appears to have only taken a day or so. It has been several days since Friday thoug
310.
by nbpoole 16y ago
Does anybody know what version of DokuWiki was being run? I'd be interested to know whether this was a 0-day exploit (and if so when DokuWiki will be patched).
311.
by nbpoole 16y ago
Disclosing a fact? No, that's not necessarily criminal. Publicly admitting to having committed a "computer crime"? That's a different story. I think the point _phred was trying to make is that publicly disclosing the issue like this puts al
312.
by nbpoole 16y ago
Well, in your original post you said: "I don't consider what I did to be a bad thing." So if you don't consider your actions to be bad or good, that means you think they're neutral? ;-)
313.
by nbpoole 16y ago
On a relative scale? Yes, wiping the system is much worse. On an absolute scale? They're both still bad: the lesser of two evils is still an evil. ;) http://en.wikipedia.org/wiki/False_dilemma
314.
by nbpoole 16y ago
Aha. That's an unfortunate situation for you. Ultimately though, it seems like you dropped the ball by leaking the code to someone else: even if you weren't responsible directly for the site or for posting the code publicly, you were the on
315.
by nbpoole 16y ago
So, just to clear something up: those links to PHPFog code are dumps that you leaked to a third party, who then posted up this website?
316.
by nbpoole 16y ago
That's a false dichotomy. You didn't have to post on their Twitter account, just like you didn't have to wipe a box or alter DNS. I hope if you learn one thing from this, it's how real responsible disclosure works.
317.
by nbpoole 16y ago
Not since the last one, but it appears the one before it had a pretty decent sized vulnerability. http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.ph...
318.
by nbpoole 16y ago
Yes, but of course this is all speculation: we don't know how this change managed to make its way to production. The fact that it happened is unfortunate, but that doesn't mean the entire engineering staff is incompetent.
319.
by nbpoole 16y ago
A very good point
320.
by nbpoole 16y ago
Ugh. Probably something having to do with this: https://github.com/github/github-services/blob/master/servic... raise GitHub::ServiceConfigurationError, "jabber hook temporarily disabled"
321.
by nbpoole 16y ago
If the custom error handler was never set, the PHP notices wouldn't look like that.
322.
by nbpoole 16y ago
I've never used it, but does the Jabber service hook not work with Google Talk?
323.
by nbpoole 16y ago
Yes
324.
by nbpoole 16y ago
It physically can't: without the opening PHP tag the parser just thinks the entire file is HTML to be outputted to the browser, which is still a valid PHP file. ;)
325.
by nbpoole 16y ago
Oh, totally. This should have been caught very quickly.
326.
by nbpoole 16y ago
Until someone types i?php when when creating the file ;) Edit: Unless of course you're using YAML or some other representation rather than a pure PHP file.
327.
by nbpoole 16y ago
Again though, PHP apps storing configuration info in PHP is a fairly common practice. If that's the way you store that information, any typo that takes your configuration file out of "PHP mode" is going to leak data. Before today, I'm sure
328.
by nbpoole 16y ago
"The only solution I see to this is pre-commit syntax checking for committed PHP files." How would that have helped here? The file was obviously still valid syntactically. Try it for yourself: create a PHP file that looks like i?php
329.
by nbpoole 16y ago
Amateurish? Incompetent? It seems a bit extreme to make those generalizations because someone made a typo in a PHP file that managed to hit production.
330.
by nbpoole 16y ago
Well, based on the code that was dumped, it looks like they're using their own error handler which was ignoring display_errors (search for "Use of undefined constant" in the dump).

More ›