Open sourcey bulletin board offline after hack attack

PHP is a tool of the devil.

Lowest common denominator of web applications, widely known for it's poor programmers and many security problems.

I know many system administrators that do not allow PHP on their servers for just this reason.

OTOH it is very easy to build interactive sites with quickly, and it is a very easy language to learn.

Which explains why it is so popular and bug ridden.

The last time I audited a popular piece of PHP software for bugs I found an exploit within an hour, despite being unfamiliar with the software. (authors were notified on a public forum because they had no private contact details available).

To be fair most of the PHP applications are much more secure these days but the less well known add ons still stuffer from the same old stupid programming mistakes.

Where's me penguin?

What are the open-source fan base going to say here? So many times I have read 'blah blah blah wouldn't happen on open source.... open source much better blah blah blah'

Are we going to see some balance from them? Don't think so. And here's the problem - when you are blinded by the wonderfulness of that which you worship, you cannot see the danger. This is true for all diehard fans, be they Linux, Open Source in general, Apple, Microsoft or whatever.

That's why I am a proud agnostic.

Looking at the milw0rm page,

You can see that one of the offending chunks of code is a mindbogglingly stupid hack to get around the fact that all sensible versions of PHP disable the 'register globals' configuration which it would appear that PHPList depends on.

'register globals' was a huge, gaping chasm of a security hole, and pretty symptomatic of the deplorable state of PHP security at the time... re-enabling it to save time updating code was never going to be a good idea.

Ease of coding in PHP, combined with a lassez faire attitude to security, combined with lazy hacks like this mean that cracking a PHPList installation wide open was only a matter of time. I wonder how well other such flaws in the code have been sorted out; the 'patch' issued for this one appears to be yet another hack to cover a hack rather than actually fixing the issue at hand.

Personally, I've always treated PHP applications with far more skepticism than their counterparts written in other languages, for reasons much like this.

Suck this freetards. (Not really)

Just reinforces my comment on another thread to a freetard/linux fanboi, there's no such thing as bug free software, patches are required no matter how much you think you don't need them.

Doesn't matter if it's free software, MS software or whatever, it all needs monitoring and regularly updating, even if the software is well written the black hats are always looking for and developing new exploits, it's all part of the game.

Paris, names and phone numbers.

trolls

PHP and BB users are well known for their higher than average (in IT) level of stupidity but even after that, parts of this article by El'Reg look like deliberate trolling attempt

Bah!

PHP is a tool of the devil.

By Anonymous Coward Posted Thursday 5th February 2009 08:27 GMT

====

What a load of cobblers. I'm not even going to bother repainting the rest of your idiotic comment on people's monitors.

The ease of use of any programming language or tool has nothing to do with the level of ease by which it can be exploited to do bad things.

Such acts are up to the user of that particular language or tool, and their creativity in developing their exploit.

As such any programming language, tool or system can be attacked and exploited quite easily if they are not supported by timely patching and regular security checks.

Your level of thoughtlessness is disturbing, mister Anonymous.

And all you like minded commenters, You should be ashamed of yourselves.

@ Ru...

It's less the fact that they basically shoehorned register globals back on (cock up #1) and more the fact that beyond that, they trusted *all* input from the $_request array as valid without verifying any of it (huge cock up #2) that bit them on the arse.

Oh, and carrying out processing on an admin page before authenticating the user too (cock up #3)...

Three proper schoolboy errors if ever I saw them.

Paris because she knows to check her input and never trust it. Maybe.