⇥ Now showing: PHP’s true colours

August 29, 2007
17 comments

⇥ Permalink

Suppose you’re a hacker. Suppose you’ve found a vulnerability in the current PHP 4 codebase. What would you do?

The scenario above is not that unlikely. Security researchers like Stefan Esser have found a number of vulnerabilities in the PHP codebase, which they have disclosed and helped fix in the past.

However, for every honest Esser out there, it’s safe to think that there are plenty of less well-intentioned people who may be able to find security issues in PHP without feeling compelled to disclose them. If they want to wreak havoc, all they have to do is wait eleven months and let all hell break loose.

The PHP 4 end-of-life announcement should be sending everyone who runs a PHP 4-based system scrambling to port their software to a newer version of PHP—or, maybe, to another language whose developers don’t feel like writing a 300-message thread to choose a keyword (sorry, internals subscribers—I love you all, but I couldn’t resist poking fun at this).

As usual, however, a lot of people are asleep at the wheel, and a lot more are just scratching their heads—likely wondering “how am I supposed to do this?”

Of these, I’m sure that a large number are owners of small hosting firms—which, by far, provide the vast majority of PHP-powered websites that Netcraft carefully tracks for us—that sell cheap shared hosting. You see, they have a rather large problem: cheap hosting makes for small profits and noisy customers.

If you provide shared-hosting plans, it’s likely that your servers are still running PHP 4. Upgrading to PHP 5 is a logistical nightmare for two reasons: first, you don’t necessarily know that you’ll be able to properly set up and secure your systems; second, you don’t know that your customers’ applications will keep on running.

The dark art of running PHP
The PHP mailing lists are littered with comments along the lines of this one—from folks who are trying to figure out how changes in the PHP codebase are going to affect their business (in this case, in the long term, but there are plenty of problems that are going to show up in the short term, too).

Hosting is essentially a numbers business. You need a given number of customers per server and a given number of servers to cover your costs—of which things like hardware, bandwidth and utilities are usually not the largest. With margins already razor-thin, having to invest in figuring out how to properly secure a server can push you over the edge—and many may choose to simply sit things out and let PHP 4 run longer than its shelf life really allows.

The customer dilemma
Hell hath no fury like a customer scorned. And the amount of fury, in my experience, is inversely proportional the amount spent. It’s unlikely that folks who decide to spend $5.99 a month for hosting have the know-how or resources to deal with porting their code from a PHP 4 base to PHP 5. What’s more, code that runs on these low-end hosting accounts is likely to be poorly written or rely on archaic techniques that have been progressively obliterated by the PHP development team because of their inherent lack of performance or unsafety.

If a hosting company simply upgrades to PHP 5, it’s well possible that the code run by a large number of its customers is simply going to stop working. Are these customers going to blame their own poor software product? Of course not—it was working before.

If there’s anyone they’re going to blame, it’s going to be the hosting companies—and, when you’re making $6 a month from a customer, a single e-mail is enough to turn whatever tiny profit you can make into a loss—particularly so because the customer is unlikely to know understand what the problem is.

What can we do?
The consequences of doing nothing can be catastrophic. Hosting companies that fail to upgrade run the risk of leaving their customers exposed to potentially serious flaws that could wreak all sorts of havoc with their code. As a community, we cannot afford to let this happen—because whatever backlash is going to take place will eventually trace its way to PHP itself.

If you own a hosting company, now is the time to let your customers know that the switch is coming. You should get your PHP 5 servers set up now and offer incentives for customers to switch their sites as soon as possible—it’s going to cost you some money now, but it will save you considerably in the future. You should also consider setting up resources that can help your customers with the switch—such as a web pages with links to relevant documentation, or a marketplace for your less tech-savvy customers to find inexpensive help to port their code over.

If you are part of the community, the best thing that you can do is to help provide a clear upgrade path from PHP 4 to PHP 5. We at php|architect are making preparations to provide a well-organized set of resources for this purpose, and there are a number of resources already available out there.

Make no mistake about it: the success and penetration of PHP 4 make this a prime problem that can have some very dire consequences on PHP itself. If nothing is done about it, when can kiss our 20 million PHP-powered sites goodbye.

Comments

Yep that’s the problem, hosting companies will not force their users to upgrade and also companies will not pay for work to be done on their sites to upgrade them to PHP 5.

I’ve got a ton of PHP 4 sites which I handle, but will the companies pay for me to work on them and upgrade them? I doubt it. It’s just too much money for them.

The reasons you touched on are the very reasons that PHP 4 is still being used today. Either PHP 5 will take over or another language will, this could be the death or rise of PHP.

Great article, i forwarded it to my webhost and he’s going to get into gear for the switch. Fortunately, most of his servers are already running on PHP5.

Well, the approach the hosting company I use uses is to provide BOTH PHP 4.x and 5.x. on different servers.

You can tell them which one you want. Or they’ll help you decide.

What’s so hard about this? If a hosting company cannot manage such a simple thing as offering different versions of PHP, then they’re fly by nighters who probably loose customers as fast as they get them.

So, from the point of view of a hosting company, the proposal is to take the pain of migrating to PHP 5, then to return to this hell when PHP 6 is released?

I’m not sure that dropping anything at this point is advantageous for anyone but the PHP internals team.

And gophp5.org is only marketing to hosting teams and developers; nobody’s trying to reach the end-users with the installed base of PHP4 apps.

It took quite a few years for PHP 4 to become obsolete, so I don’t think that PHP 5 is going to go the way of the dodo that quickly.

I never said that dropping PHP 4 is advantageous to the hosting companies. My post is about the fact that whether you like it or not this problem is not going away—and a lot of people are not doing anything about it.

I can happily recommend ICDSoft as a nice, cheap shared-hosting site that has offered the choice between PHP 4 and PHP 5 (on the same server, on a per-directory basis) for well over a year now.

The other part of the puzzle is for users to be savvy enough to choose applications that are friendly to PHP 5. The PHP apps I run on a few different sites are Serendipity, dokuwiki, WebCalendar, Gallery, and Drupal.

Maybe I’m atypical, but I’m not getting all worked up about the death of PHP 4. The major apps already work with PHP 5; the minor apps that don’t work are probably due for a re-evaluation anyways.

Mr. Cavalier Attitude,
Dan

A2 Hosting is getting rid of their last 3 PHP 4 servers in September. Anyone hosting there *has* to be PHP 5-compatible

For all the hosting companies struggling with this problem, please have a look at my article ‘Migrating from PHP4 to PHP5: A strategy for ISPs’.

It shows you how to set up a second instance of Apache on a different port (8800), running PHP5. Which gives your customers a chance to check if their site runs well under PHP5 before switching.

PHP5 has been available for 3 years, the hosting companies have had plenty of oppotunity to make the switch – I have absolutely no sympathy for those who have left it til the last minute, and even then needed to be pushed.

There’s another possibility: PHP is open source software. Nothing prevents a new team from picking up PHP4 and continuing to support it with security upgrades. This would be far from a trivial undertaking but it’s absolutely within the realm of possibility. Businesses with a financial interest in remaining on PHP4 would do well to support any such effort ($).

徵信, 徵信社, 感情挽回, 婚姻挽回, 挽回婚姻, 挽回感情, 徵信, 徵信社, 徵信, 捉姦, 徵信公司, 通姦, 通姦罪, 抓姦, 抓猴, 捉猴, 捉姦, 監聽, 調查跟蹤, 反跟蹤, 外遇問題, 徵信, 捉姦, 女人徵信, 外遇問題, 女子徵信, 外遇, 徵信公司, 徵信網, 徵信, 徵信社, 外遇蒐證, 抓姦, 抓猴, 捉猴, 調查跟蹤, 反跟蹤, 感情挽回, 挽回感情, 婚姻挽回, 挽回婚姻, 感情挽回, 外遇沖開, 徵信, 徵信, 徵信社, 抓姦, 徵信, 徵信社, 外遇蒐證, 外遇, 通姦, 通姦罪, 贍養費, 徵信, 徵信社, 徵信社, 抓姦, 徵信社, 徵信社, 徵信, 徵信, 徵信公司, 徵信社, 徵信, 徵信公司, 徵信社, 徵信社, 徵信社, 徵信社, 徵信社, 徵信公司, 徵信社, 徵信, 徵信, 徵信公司, 女人徵信, 外遇, 外遇, 外遇, 外遇

徵信, 徵信網, 徵信社, 徵信網, 徵信, 徵信社, 外遇, 徵信, 徵信, 徵信社, 抓姦, 徵信, 徵信社, 外遇, 徵信社, 抓姦, 徵信社, 徵信公司, 徵信, 徵信社, 徵信公司, 徵信, 徵信社, 徵信公司, 徵信社, 徵信社, 徵信社, 徵信社, 徵信, 徵信社, 徵信社, 徵信社, 徵信,

This blog is really a love

.| .|.|.|.|.|.|.|.|.|.|.|.|.|.|.|.|.|.|==|？？|·| ……|*|·|￥|*|·|*|#|·|￥|……|—|%|*|—|+|·|%|—|—|￥|—|R|·|#|%|#|·|#|……|·||#|……|||%|.|.|.|.|.|.|.|.|.|.|.|.|.|.|.|.|.|.|.|.|. |T. |. |. |. |. |. |. |. |. |. |. |. |. |. |. |.|. |. |. |……|……|#|·|·|·|·|·|·|·|·|·|·|·|·|·|·|·|·|·|·|·|·|·|·|·|·|·|·||·|·|·|·|·|·|·|·|·|·|·|·|·|·|·|

這一家租屋網免費刊登不用錢耶，超好康的想出租房子快來吧！
專業搬家公司,服務第1,顧客至上,是你值得托負終生的好伙伴!精緻搬家公司主要是在為大家服務搬家為目的,本網站服務項目以,搬家公司、回頭車,家庭搬家,工廠搬遷,為主要,服務地區台中搬家,台北搬家公司,全省搬家公司,歡迎洽詢

順便介紹一下室內設計在國內的發展，已到了一個急待突破的瓶頸階段。雖然，在裝潢學界，我們已建立了從高中、高職、五專、二技、四技、大學到研究所相當完整的室內設計相關專業教育體系，在業界，相關從業人員至少也在數萬人以上，而民間人士對於住宅、商空、辦公室等各類空間室內設計之需求也隨著經濟的不斷成長與社會進步而日益殷切。表面上看來，室內設計似乎蓬勃發展、坦途在望，但事實並非如此。此一領域至今仍有許多問題急待克服與解決，而其中最主要的問題之一是官方一直將「室內設計」視為是依附在建築之下的附屬品，而非一獨立之專業。這種情形，我們從內政部所公布施行的建築物室內裝修管理辦法之內容便可清楚看出。

此一未與學界、業界充分溝通即匆促制訂、且施行後成效不彰的室內設計管理辦法可說問題重重，值得深入檢討，以謀徹底改善之道。

　　官方對於「室內設計」未能正確定位可說是問題的主要根源之一。此一瓶頸如無法突破，則室內設計將永遠只是附屬於建築底下的一個妾身未明、專業地位未受尊敬與肯定的灰色領域。這種情形對多年來努力建立室內設計專業教育體系的學界、以及辛勤接受室內設計各級專業教育的諸多莘莘學子而言，真是情何難堪。何以同樣在中華民國教育制度下，一樣的修業年限，一樣具備完整的專業教育體系，建築、土木等領域的畢業生就有機會取得官方對其專業地位的認定，其權利能受法律保障，而修習室內設計公司的室內設計者就只能參加建築物室內裝修專業技術人員之講習與測驗，還需在建築師、建築公會或其他相關專業團體之審核查驗下夾縫求生？這對室內設計領域是不公平的。如果不是其他專業領域之專業知識與技能未能完全涵蓋、不足以有效處理室內設計相關問題，何以有室內設計存在的空間？又何需大費周章建立從高中到研究所的專業教育體系？可見室內設計有其存在的必要與價值，也有其獨具的（與其他專業有所區隔的）專業知能。
再談談網站優化SEO方案的優勢和效果保證：

網路行銷管理顧問的專業實力決定了在網站優化方案及實施方面具有獨特的優勢，主要表現在下列方面：

領先的網路行銷導向網站建設理論和系統的網站優化思想指導；

作為中國中國互聯網協會網站建設指導規範的主要起草人，對網站規範（網站優化是網站規範的基本組成部分）的認識更為深刻；

對利用國際WEB標準實施網站重構有著豐富的經驗；

從網站運營策略層面進行整體網站優化，是網站運營導向的網站優化方案而不僅僅是為了搜尋引擎排名，單純的搜尋引擎排名效果是局部的、短暫的，也可能是後患無窮的；
需要找健身中心幫你健身嗎？會變瘦唷！喝茶葉也會被瘦呀！不信你看看A片的女生都好瘦

SEO不等於網站優化，不提供片面的，實踐表明只有系統的網站優化才能達到最好的、持久的搜尋引擎優化效果；

基於用戶行為的研究，通過網站SEO優化為用戶提供最有價值的信息和服務，為瀏覽者轉化為顧客奠定基礎；

為眾多不同規模的企業網站及電子商務網站提供網站優化方案、實施及運營維護，豐富的網路行銷實踐經驗，讓網站優化深入到網站運營的每個細節，這是網站優化得以成功的基本保證。
好了說完了，以下幾個站點不錯，累的話來去motel休息一下吧！有空能去看看

優質站點介紹：led手電筒,棧板,二胎,隔熱紙,照明,健身,a383,a383,兼職小姐,二手家具,a383有人要去嗎？
美美的led胸章好美唷，放在車燈上面照的很亮

文山搬家

台北搬家公司
 客人來看看唷！最新網路行銷方式
情趣用品這一款超好用的說！
情趣用品好好用！

嘻哈論壇|
Taiwan City|
you tube中文版|
skype中文版下載
 kmplayer繁體中文版
 迅雷5下載
 bt程式下載
 cs1.6主程式下載
 winrar免費下載
 nds遊戲下載
 KMPlayer下載
 無蝦米正式版xp
海賊王漫畫連載
 emule繁體中文版
 directx9.0免費下載
 office 2007下載
 無蝦米vista正式版
 爆爆王無敵程式
 rmvb播放程式下載
 遊戲天堂楓之谷
 生份證產生器
 最新線上遊戲排行榜
 photoimpact下載
 kmplayer繁體中文版
 戰鎚online官方網
 sao突襲online =========================================

==============================================================

搬家搬家搬家公司搬家搬家 Shade sail nike shoes MBA 在职研究生在职博士徵信社徵信室內設計室內設計代償房屋貸款信用貸款外遇離婚抓姦外遇蒐證外遇抓姦侵權仿冒應收帳款工商徵信徵信徵信社外遇徵信徵信社外遇电动隔膜泵自吸泵化工泵离心泵磁力泵螺杆泵水泵隔膜泵气动隔膜泵百家乐轮盘 21点德州扑克百家乐系统真人娱乐场百家乐足球德州扑克电子游戏英格兰超级联赛德国甲组联赛意大利甲组联赛西班牙甲组联赛法国甲组联赛欧冠杯英超足球比分足球彩票体育彩票即时比分免費a片 a片免費av 色情影片情色情色網色情網站色情成人網成人圖片成人影片 18成人 av av女優 av av女優性情慾走光做愛 sex H漫情色情趣用品情色 a片 a片成人網站成人影片情趣用品情趣用品アダルトアダルトアダルトサイトアダルトサイト情趣用品搬家搬家服務搬家保障搬家網搬家估價徵信徵信的意義徵信服務徵信報導徵信問答徵信知識婚禮佈置婚禮佈置
 http://www.life13.com

Enter the necessary language translation, up to 200 bytes winter, moves frequently in China, tn chaussuresshowing that the deep strategy of the Chinese market. Harvard Business School, according to the relevant survey data show that in recent years the Chinese market three brands nike chaussures, Adidas, Li Ning market share at 21 percent, respectively, 20%, 17%. The brand is first-line to three lines of urban competition for mutual penetration. Side of the world, announced layoffs, nike tnwhile China’s large-scale facilities fists. The sporting goods giant Nike’s every move in the winter will be fully exposed its strategy. Years later, the Nike, Inc. announced the world’s Fan

⇥ Now showing: PHP’s true colours

Comments

Leave a comment