111–120 of 125 posts
If I ever have a semi-successful site, I'm going to register sitenamesucks.com as well, and use it as a status blog to explain downtimes, etc.
Earlier quoted context omitted.
This is just precious: @ElliotSpeck: > ...I'm available for consulting if you ever want to hire a security manager for @phpfog. :) As someone who takes security seriously, and manages shared hosting security for a living, I can't imagine what the PHPFog people are going through right now. Finding security holes in commercial systems and discreetly notifying the owners of the problem is one thing; broadcasting knowled…
> Finding security holes in commercial systems and discreetly notifying the owners of the problem is one thing Last time this happened to me, I gave 6 months free on a dedicated server which was announced in an e-mail that went out to around a thousand users (the focus was explaining why feature x was disabled for the past few days). It was brought up in discussion that it was probably too much, but the alternative t…
Earlier quoted context omitted.
> broadcasting knowledge of the holes to the world without a reasonable wait is akin to criminal I wouldn't go as far as that. It's sure bad form, but disclosing a fact (maybe with the exception of immediate national security concerns) can't be considered a crime. This will cost the PHPfog folks some and they can - and should - pursue civil action against whoever causes damage to them.
Disclosing a fact? No, that's not necessarily criminal. Publicly admitting to having committed a "computer crime"? That's a different story. I think the point _phred was trying to make is that publicly disclosing the issue like this puts all of the sites on PHPFog at risk.
After berating one of the "d00ds" involved on Twitter, it looks to me like he told his friend how to exploit the problem, and his friend (or his friend's friend) made the site and exploited the hole.
If I show someone how to break into your house, and that person tells someone else "hey, nbpoole's house is open, let me show you," and your house gets broken into am I completely innocent of the crime? Security knowledge is the kind of knowledge that gets things broken into, so security people need necessarily be cautious with who they tell about security problems.
Earlier quoted context omitted.
PHP is just as secure as any other language. It's the programmer's best practices (or lack of) and implementation that can make the code secure or insecure. The language is mature, actively maintained, and has a nice standard lib (debatable). Whether or not YOUR program will be secure depends on you the PROGRAMMER not the language.
PHP is, by no means, just as secure as any other language. It has a horrid security track record when compared to any other language.
I agree with other views that it is the programmer's code that is insecure, not the language itself.
What a dick move. Did these idiots actually publish their names in relation to this? Coming from "security experts" this is the most unprofessional thing I've ever seen.
Astonishingly classless and mean-spirited. Especially this part: "feel free to harass the staff in their support forums..." The founder and CEO of PHP Fog is extremely active in their support forum. He provides lightning fast responses, and is really proactive at trying to help. I mentioned that my app was undergoing a traffic spike, and he personally on his own initiative ran some tests to help me understand how to…
[1] http://forum.kohanaframework.org/discussion/8452/need-help-w...
Can someone elaborate? I was at a baseball game and now all I see is "Goodnight sweet prince".
Earlier quoted context omitted.
It should be easy enough to throttle bandwidth on the instances.
As far as I know that cannot be done with standard Amazon tools
Earlier quoted context omitted.
During which weekend? For my new place of work that would be on Friday & Saturday.. (Just a quick note that some features are harder than it seems at first)
I realize that it's harder than it looks. However, it would be trivial to allow people to choose the days they don't want the procrastination setting enabled (based on a standard timezone like PST.)