21–30 of 47 posts
I realize that this is a totally different strategy to solve the mySQL admin thing, but WOW is Sequel Pro great if you're on a Mac: http://www.sequelpro.com/ I used phpMyAdmin for 10 _years_, and switched after using Sequel Pro for 5 minutes.
There is no need for this software to exist. No need. No need for it to exist.
Every one of these kind of accounts I've got, and the ones I'm happy to help friends out with, are all cpanel accounts, so I've pretty much always got phpmyadmin available.
I'm not saying Bike (or phpmyadmin) are a good idea - but I do have a need for something like it to exist.
(Arguably, if this software _didn't_ exist, webhosting companies would maybe give shell more readily to even the lowest of low-end hosting accounts, but that's not the reality I live in right now.)
The issue behind phpMyAdmin IMHO neither is the fact that it's written in PHP nor that it looks unsexy. The problem is that it exists. It's too tempting to leave it running on some server and promptly forget it. Or get it installed without knowing by some third-party CMS. Even if it had a spotless security track record (it doesn't), this is just too big an attack surface. MySQL and especially Postgres have really goo…
I either command line in over SSH or open up a tunnel and use SQLYog.
If you go to their github page it says the following under security: "On current stage I don't care about login functionality. Put Bike into folder with name like 'tASTDKUWYVEjhas' or just use Apache httpauth as workaround." So basically... they have absolutely nothing built in for security, other than hoping you choose a good folder name. Even if you ignore that, this is an all-around poor attempt to be an alternati…
So I wonder how long before this becomes a trending search query?
https://www.google.com.au/search?q=inurl%3A%2Fbike+%22Run+Qu...
(a slightly more refined version of that search, which I'll leave as an exercise for the reader, has already revealed 3 probably exploitable urls, based on the google snippet - I'm not prepared to click the links to confirm…)
While I can understand the author writing a tool that scratches his own itch, where that itch doesn't include the need for strong access control for the tool - releasing it in a "default unsafe" configuration seems, ummmm, unwise. I'd suggest perhaps publishing the software with a hardcoded 10..1 ip address as the only address it'll respond to, so that you can't just download and run it with the result of a wide-open access to your databases. If someone's savvy enough to safely use the tool, updating that hardcoded ip address to their own will be obvious, and while opening it up to the world will still be _possible_, at least it'll require some intentional effort.
The issue behind phpMyAdmin IMHO neither is the fact that it's written in PHP nor that it looks unsexy. The problem is that it exists. It's too tempting to leave it running on some server and promptly forget it. Or get it installed without knowing by some third-party CMS. Even if it had a spotless security track record (it doesn't), this is just too big an attack surface. MySQL and especially Postgres have really goo…
So wouldn't you just setup a simple secure tunnel and run this on your local dev machine (with key-auth and an ssh agent to manage the connections)? That's how I run my phpAdmin. No server security issues.
The issue behind phpMyAdmin IMHO neither is the fact that it's written in PHP nor that it looks unsexy. The problem is that it exists. It's too tempting to leave it running on some server and promptly forget it. Or get it installed without knowing by some third-party CMS. Even if it had a spotless security track record (it doesn't), this is just too big an attack surface. MySQL and especially Postgres have really goo…
So wouldn't you just setup a simple secure tunnel and run this on your local dev machine (with key-auth and an ssh agent to manage the connections)? That's how I run my phpAdmin. No server security issues.
If you go to their github page it says the following under security: "On current stage I don't care about login functionality. Put Bike into folder with name like 'tASTDKUWYVEjhas' or just use Apache httpauth as workaround." So basically... they have absolutely nothing built in for security, other than hoping you choose a good folder name. Even if you ignore that, this is an all-around poor attempt to be an alternati…
I realize that this is a totally different strategy to solve the mySQL admin thing, but WOW is Sequel Pro great if you're on a Mac: http://www.sequelpro.com/ I used phpMyAdmin for 10 _years_, and switched after using Sequel Pro for 5 minutes.
I realize that this is a totally different strategy to solve the mySQL admin thing, but WOW is Sequel Pro great if you're on a Mac: http://www.sequelpro.com/ I used phpMyAdmin for 10 _years_, and switched after using Sequel Pro for 5 minutes.
I realize that this is a totally different strategy to solve the mySQL admin thing, but WOW is Sequel Pro great if you're on a Mac: http://www.sequelpro.com/ I used phpMyAdmin for 10 _years_, and switched after using Sequel Pro for 5 minutes.