Forum Moderators: coopster
The feeling was,
not at all
I don't know who wrote it and I sure don't know their level of expertise. Most OS software I've used I have had to rip apart and usually redo a chunk of the security, if not all of it.
I see so many people blindly using anything they find on their sites, the thought makes my skin crawl.
What are the first steps you take when looking at, or using, OS PHP software?
once i get my hands on something usefull, i use it to tutor myself.
I seldom find a script that will suit my needs 100% or my clients needs 100%. Almost all scripts require modifications and alterations in their core to fit into my projects.
But in case i find a usefull (copy/paste) script....
then you are correct... i use it blindly... as it is, no thought into it, no code changes (so far this has happened 2 times, both for forum scripts).
Further I found that none of them really meet my requirements, so it calls for tons of modif, that why
I actually rely only on my own stuffs but for carts, I won't take a chance and always purchase a brand that has passed strict security tests.
Greatest use of open src: I love performing on them a “post mortem”
And discover a bunch of new solutions and ideas
For example recently I found (cannot even remember where) a very nice and easy way to make available BBcode.
I agree that scripts found on the web and blindly used are not good for your security. As if you dont understand then you dont know the problems with the script. However I would have to disagree that PHP, PERL, Apache, Linux or any of the other large professional open source distributions have any more security holes in than a closed source distribution like Windows. With a larger number of people looking at the source for PHP the bugs and security holes get found quickly, reported and (hopefully) fixed. Windows never gets rid of half of the problems, it gets upgraded and the problems start again.
It may be a little unfair to pick on windows, however it is the largest closed source distribution I can think of, so it is a good example.
So are you really saying open source is bad, or that non-professional software is bad? As there are plenty of rubbish closed source bits of software as well ;)
not at all I very much trust PHP but I just don't trust any programmers, even myself. I especially don't trust anyone who uses the word secure while explaining anything in regards to computers or software. I was referring to software created with PHP as opposed to PHP itself.
I guess I could argue that the PHP has helped lower the threshold for programming and has caused a lot of garbage to be quickly adopted.
I don't really trust any software, I figured people asked for software in here enough I could add PHP to the title so I could post it in here. ;)
I'm sure that the average open sources software has much fewer security holes than the average bespoke script; the difference is that it's a lot of work to find the holes in the bespoke script as compared to the open source script which is frequently hacked entirely automatically and in bulk.
Closed source software does have a security bonus... attackers can't see the programmers exact mistakes then exploit them. They say security through obscurity is a bad thing, but frankly, it still helps.
On the flip side, not being able to see the programmers mistakes doesn't change that they exist. Open source's security "weakness" is also it's security strength... more eyes means more people can find and report mistakes. Over the lifespan of an open source project, this makes for more secure software. However, a new project or a project with very few contributors will never see this benefit.
As the open source community are willing to help each other with scripts we expose ourselves to people that may not actually know anything. This is a risk that people need to accept when they ask for help, as there is no guarantee that a person that has been coding for years will not have a bad day, or worse hasnt been doing a poor job for all of those years. Just a search on the web for all of the people using add_slashes instead of mysql_real_escape_string proves the number of people that could be doing it better (or a search for the number of times the same has been mentioned on this forum).
I'm ex-military so have been involved with security of a different nature; and there is (ok, should) always a backup plan for what happens when the security fails. As it is inevitable that with enough time any amount of security will fail (either through bad luck or poor planning), the problem then is recovery or minimizing loss.
So its not just software where the concept of 'total security' is a problem, its life in general...as there never seems to be a backup plan.
How many times @ WebmasterWorld do we see someone asking for help with a statement similar to “I found it on the web; but it does not work!”
And knowledge is not enough, even what works today might not tomorrow, nowadays knowledge consists in trying to keep oneself learning more, reading more etc.., the web was an easy proposition years ago, no sql injection, no ID stolen etc…
For example I am in the process of rewriting just a whole bunch of scripts to provide a flood control.
I bet a bunch of us haven’t assess that risk yet!
Security threats come from:
In my opinion, you are safer to stick with one of:
