Please tell me that the people writing this PHP abomination have *nothing* to do with the people developing your hardware tokens. Please. Maybe I should really start looking into alternative products...
-
Show this thread
-
Seriously, how incompetent do you have to be to not only write code like this, but also *once the bug is found, completely fail at educating yourself as to what the correct, sane, safe way to fix it is*? I might excuse lack of knowledge, but not the utter inability to learn.
1 reply 8 retweets 117 likesShow this thread -
Seriously, this incident raises *serious* questions about the quality of development at
@yubico. It might be an isolated problem, but how did this mess slip through the cracks? Who reviewed this code? Does an entire team at Yubico think this is okay? Who hired them?1 reply 7 retweets 84 likesShow this thread -
Do the same standards apply to every other team at
@yubico? How do we know this isn't a pervasive problem? Are there any companywide standards on code quality? Is there even a security team dedicated to auditing stuff in general? HOW DID THIS HAPPEN?!?3 replies 2 retweets 61 likesShow this thread -
Hector Martin Retweeted Hector Martin
Btw, someone joked about http://php.net having this as the correct solution, and, well. But "knowing better than http://php.net " is definitely a prerequisite to be in the security business writing PHP. Or just don't write PHP.https://twitter.com/marcan42/status/1089238169839489025 …
Hector Martin added,
Hector Martin @marcan42It's 2019 and PHP is *still* teaching people to concatenate SQL and vaguely-sanitized user input instead of using prepared statements. http://php.net/manual/en/mysqli.examples-basic.php … They got rid of the mysql module... only to teach people to use mysqli the same way. This is why SQLi isn't going away.3 replies 8 retweets 105 likesShow this thread -
Replying to @marcan42
Not sure that it's PHP that's at fault. You could write this same problem in pretty much any language
1 reply 0 retweets 0 likes -
Replying to @ofcAnthony
But most other programming languages don't teach people to make this mistake in their *official documentation*.
1 reply 0 retweets 4 likes -
Replying to @marcan42
Don't disagree. I was referring to your latter point of "don't write PHP"
1 reply 0 retweets 0 likes -
Replying to @ofcAnthony @marcan42
so continue to write in a language that is unsafe by default and the official docs don't help you either....why? do you also eat soup with a fork?
1 reply 0 retweets 0 likes -
Replying to @moljac024 @marcan42
Show me a language that doesn't allow you to concatenate strings and use the result as a query. The docs are a problem, sure, but it's the developers and the education. It's not the language, and the language shaming was boring 10 years ago, it still is today
1 reply 0 retweets 0 likes
Culture matters. The problem is that a newbie trying to learn PHP and googling for answers is going to come across much lower quality code than a newbie learning something like Python. Even with the recent core PHP fixes, this is a problem the PHP community may never solve.
-
-
(And the docs are evidence of the problem being systemic and severe; if the docs are this bad, imagine how much worse all the random blogs are!)
1 reply 0 retweets 1 like -
Replying to @marcan42 @moljac024
You'll not get an argument from me here. I saw people writing tutorials that were susceptible to SQLi and using a deprecated interface literally days before said interface was removed when PHP 7 was released. I've seen too many of those blogs
1 reply 0 retweets 0 likes - Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.