Live data from Hacker News

PhpMyAdmin Project Successfully Completes Security Audit

phpmyadmin.net

101–110 of 112 posts

Re: PhpMyAdmin Project Successfully Completes Security Audit

#101
post #99
post #89

Earlier quoted context omitted.

Or learn how to use the CLI client to connect. No need to install a awkward wrapper software layer.

You seem to be a software developer who is advocating that people not automate something that's tedious (writing and running SELECT and UPDATE queries). Weird.

You can automate with scripts. No need to use a fancy GUI for this.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#102
post #99

Earlier quoted context omitted.

You seem to be a software developer who is advocating that people not automate something that's tedious (writing and running SELECT and UPDATE queries). Weird.

You can automate with scripts. No need to use a fancy GUI for this.

And what if I don't want to write scripts because other people have already automated all common database browsing/editing tasks for me? What if I don't want to reinvent the wheel?

With a GUI, you can click 3 times and browse 3 tables. That's just not possible without a GUI.

If GUIs didn't save people (lots of) time, no one would have invented them and the software industry would be moving away from them.

Besides being way faster and more efficient, GUIs do things that CLIs don't:

- linting/error-checking/autocomplete for SQL

- checking query sanity (warn before an unconstrained DELETE for example)

- copy/paste data (within the database and between applications)

- jump from FK cell to the row it references

The list goes on.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#103

I encourage people to google how to run phpMyAdmin, MySQL Workbench, or Sequel Pro locally, and use port forwarding over SSH. It's super simple. Here is a command that forwards all traffic to localhost:3306 across the ssh tunnel to example.com:3306 (the mysql default port). ssh user@example.com -L 3306:localhost:3306 I would never run a DB admin application on the live server because it's just one more piece that mig…

Another option is to install these tools at a separate domain and setup HTTP authorization on a webserver. So automated bots scanning for vulnerable apps will not get even to the login page.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#104
post #102

Earlier quoted context omitted.

You can automate with scripts. No need to use a fancy GUI for this.

And what if I don't want to write scripts because other people have already automated all common database browsing/editing tasks for me? What if I don't want to reinvent the wheel? With a GUI, you can click 3 times and browse 3 tables. That's just not possible without a GUI. If GUIs didn't save people (lots of) time, no one would have invented them and the software industry would be moving away from them. Besides bei…

Scripted migrations have their advantages too:

- they can be stored in a version control system

- your coworkers can run them at their dev environment

- they can be used for automatic deployment

- you can test it in a dev environment before running at a production server. With GUI tools you have to remember and repeat exact steps you did before

- You can review the script or ask someone to look at it

I think GUI tools might be good for browsing and exploring database but not for making changes.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#105
post #20

Earlier quoted context omitted.

MySQL Workbench works fine though?

Last time I tried it (about two years ago). It would crash all the time on Ubuntu. Went back to PHPMyAdmin.

Mine kept crashing on Mac when viewing table information, turns out it was some old subversion plugin that integrated into the OS shell.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#106

Earlier quoted context omitted.

Apart from security, are there any other benefits?

Sequel Pro (free open source, despite name) is a native application which is much nicer to use than phpMyAdmin. So, yes there's benefits other than security.

Also very good: https://github.com/webyog/sqlyog-community

Re: PhpMyAdmin Project Successfully Completes Security Audit

#107
post #91

Earlier quoted context omitted.

Yes it is. It is a bug, that may be exploitable. There's no contradiction there.

Global variables are not bugs -- at worse they are bad style and can cause bugs. As for your other comments, there's this "burden of proof" thing.

Did you reply to the wrong comment by mistake? What other comments? What are you talking about?

Re: PhpMyAdmin Project Successfully Completes Security Audit

#108
post #99
post #89

Earlier quoted context omitted.

Or learn how to use the CLI client to connect. No need to install a awkward wrapper software layer.

You seem to be a software developer who is advocating that people not automate something that's tedious (writing and running SELECT and UPDATE queries). Weird.

phpMyAdmin is not automation. It's a less-painful manual interface.

Tedium in a GUI is still tedium.

Post reply on HN