Comments on: Secure is, as Secure does. http://thirdpartycode.com/2007/05/secure-is-as-secure-does/ Linux, PHP 5, Apache Consulting in San Antonio, TX Thu, 05 Aug 2010 12:40:23 +0000 hourly 1 http://wordpress.org/?v=3.0.1 By: Torrential Web Dev http://thirdpartycode.com/2007/05/secure-is-as-secure-does/comment-page-1/#comment-78 Torrential Web Dev Fri, 25 May 2007 20:37:10 +0000 http://www.phpcult.com/blog/24/secure-is-as-secure-does/#comment-78 <strong>The "I'm Alive" Entry</strong> Things have been quiet around here in terms of entries so to keep things rolling here are a few interesting links I've discovered over the past few days . . . Florian posted a comment over on the msn contact grab entry highlighting a warning error... The “I’m Alive” Entry

Things have been quiet around here in terms of entries so to keep things rolling here are a few interesting links I’ve discovered over the past few days . . .

Florian posted a comment over on the msn contact grab entry highlighting a warning error…

]]> By: Jeff Dickey http://thirdpartycode.com/2007/05/secure-is-as-secure-does/comment-page-1/#comment-79 Jeff Dickey Fri, 25 May 2007 15:46:30 +0000 http://www.phpcult.com/blog/24/secure-is-as-secure-does/#comment-79 I think you're right, both about this being a good-sense way to handle things and about the futility of automagically patching existing installs. I'm sure, however, that the companies or communities around existing packages with histories of problems in the past (*cough* WordPress *cough*) could throw together a Google mashup to (hypothetically) go find all Google-visible instances of FubarBlog before version X.Y, grab the blogger's email address (either through metainfo or screen-scrape, since they know what they're looking at), and slap him upside the electronic head. Of course, that has two problems: 1) it annoys the guy who is just using his host provider's installed service, over which he has no control; 2) if the Good Guys can do it, the Bad Guys can too - and fully automate defacement of vulnerable blogs. *shudder* Sticking our heads under the collective sand will NOT do anything for Problem 2. Problem 1 may be beneficial; if Loser-ISP.biz won't fix their systems after customers complain, then there are always other hosting providers out there, and people will (eventually) vote with their feet and their kopecks. Wasn't this sort of how the Morris Worm got started? I think you’re right, both about this being a good-sense way to handle things and about the futility of automagically patching existing installs.

I’m sure, however, that the companies or communities around existing packages with histories of problems in the past (*cough* WordPress *cough*) could throw together a Google mashup to (hypothetically) go find all Google-visible instances of FubarBlog before version X.Y, grab the blogger’s email address (either through metainfo or screen-scrape, since they know what they’re looking at), and slap him upside the electronic head. Of course, that has two problems:
1) it annoys the guy who is just using his host provider’s installed service, over which he has no control;
2) if the Good Guys can do it, the Bad Guys can too – and fully automate defacement of vulnerable blogs. *shudder*

Sticking our heads under the collective sand will NOT do anything for Problem 2. Problem 1 may be beneficial; if Loser-ISP.biz won’t fix their systems after customers complain, then there are always other hosting providers out there, and people will (eventually) vote with their feet and their kopecks.

Wasn’t this sort of how the Morris Worm got started?

]]>