|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware]
From: Bill Nash (billn
billn.net)
Date: Mon Jan 01 2007 - 11:53:39 CST
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
On Sun, 31 Dec 2006, Kevin Waterson wrote:
> This one time, at band camp, Gadi Evron <gelinuxbox.org> wrote:
>
> >
> > Indeed, the most annoying thing about the PHP worms today is that these
> > PHP vulnerabilities being exploited are everywhere.
>
> These are not PHP vulnerabilities, these are application vulnerabilities.
>
I agree. Unless this thread is focusing on vulnerabilities in the
PHP parser itself, exploitable simply by pushing arbitrary information
through any available post/get channel, then I think we can call it a PHP
vulnerability. Until then, let's keep the FUD to a minimum.
*ANY* language implemented for *ANY* purpose is as secure as the
programmer makes it. The way the original post is written,
s/PHP/(Perl|ASP|C|bash|BASIC|four little buddhist monks fighting over an
abacus)/ is applicable. The vulnerabilities that we see, that Gadi refers
to, aren't widespread because PHP is widespread, but because insecure
applications written in PHP are. A better use of energy would be
focusing on the most vulnerable platforms and educating the developers.
- billn
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]