"Unsafe PHP" Isn't that a bit redundant?
No.
Magento eCommerce PHP Remote Code Execution
21–30 of 81 posts
Re: Magento eCommerce PHP Remote Code Execution
#22"Unsafe PHP" Isn't that a bit redundant?
As someone who routinely finds security bugs in popular PHP frameworks... no, it really isn't.
Re: Magento eCommerce PHP Remote Code Execution
#23Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk. Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible. On the positive side Magento does have an impressive amount…
Its performance is so scant one must cache it to oblivion. This is especially true when you hit a certain high SKU threshold. Not to mention the horrible modules that are out there in the market.
Plug: Had to write a full page caching mechanism that's powered by Varnish (dubbed Magento Warp - http://www.unixy.net/varnish/ ).
Re: Magento eCommerce PHP Remote Code Execution
#24Re: Magento eCommerce PHP Remote Code Execution
#25Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk. Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible. On the positive side Magento does have an impressive amount…
Magento code in general is of very dubious quality. I once ran a quick static analysis on it and found some ridiculous results: https://twitter.com/jlas_/status/391615992473722880
That's somewhat terrifying
Re: Magento eCommerce PHP Remote Code Execution
#26Earlier quoted context omitted.
But they did, didn't they? There's a security patch and they're nagging people to install it. What are they failing to do?
Normally, if you have a security patch you release a new version containing that patch. 1.9.0 -> 1.9.1.
No see 1.9.1 has the Configurable Swatches in it.
Joking aside, they are going to release 1.9.2 soon. For Magento 1 they're still doing feature releases, and they do patches for everything else because store owners do not like going through the upgrade process.
The only problem arises when people download fresh versions.
Re: Magento eCommerce PHP Remote Code Execution
#27Earlier quoted context omitted.
As someone who routinely finds security bugs in popular PHP frameworks... no, it really isn't.
What's your opinion on "popular frameworks".
They vary; generally, their maintainers mean well but that doesn't necessarily translate to secure code.
Cake lacks security expertise in their core team, unfortunately.
CodeIgniter is a bit conservative. (We must support PHP 5.2!) But then again, so is WordPress. They do listen to researchers.
Laravel is okay, but their lead dev is a bit of an egotistical and hypocritical ass. Recently, found and privately reported a PHP Object Injection vuln to Laravel; he said he didn't consider it a security issue, then when I disclosed publicly flipped his shit on me.
Symfony is great. Fabien has a cool head and responds well to security researchers.
Yii 2 is promising. I'll have to take another look before I call it bulletproof though.
My only experience with Zend has been interacting with their core devs on other media (Twitter, IRC); I haven't found any bugs in its core.
Re: Magento eCommerce PHP Remote Code Execution
#28Regardless the way Magento releases the patches, the most annoying thing is hiding them behind the login form, making it impossible to apply from the console. You can install Magento via SSH, but you cannot apply security patches the same way - I am not able to understand this. I know, there's a business behind this, but open source in Magento meaning is somehow strange.
Re: Magento eCommerce PHP Remote Code Execution
#29This is hardly unique to Magento. Lots of applications do this. It's not ideal, but it's not SO bad if the application nags you to patch on start up. I don't use Magento, so I'm not sure if it does.
Yes. Among them, Vim, Bash, and OpenBSD, the latter of which supposedly has a very good reputation on security.
Re: Magento eCommerce PHP Remote Code Execution
#30Earlier quoted context omitted.
What's your opinion on "popular frameworks".
They vary; generally, their maintainers mean well but that doesn't necessarily translate to secure code. Cake lacks security expertise in their core team, unfortunately. CodeIgniter is a bit conservative. (We must support PHP 5.2!) But then again, so is WordPress. They do listen to researchers. Laravel is okay, but their lead dev is a bit of an egotistical and hypocritical ass. Recently, found and privately reported…
Thanks, this was informative :)