News for hackers. Stuff that matters.
Re:PHP 5 and 7.0 end of life by userbinator on Friday July 19, 2019 @07:58AM (#20477870)
Besides the "doesn't bother updating the passwords" point, this sort of "it's old so let's change it" attitude is unfortunately so pervasive in the software industry and I find it massively irritating because it's the same reason why a lot of software has gotten increasingly unstable over time. Instead of making only fixes and bringing a platform towards maturity they do the exact opposite, adding plenty of new bugs and breaking changes.

Keep in mind that the majority of people who need PHP (and technology in general...) have far more important things to do with their time than incessant trendchasing.

The saying about "known unknowns" and "unknown unknowns" is worth remembering too. The fact that a system has stayed working for over a decade should be enough to tell you that its creators did something right.

(I am in the process of restoring an 80-year-old refrigerator. ;-)

Re:PHP 5 and 7.0 end of life by onion2k on Friday July 19, 2019 @09:04AM (#20478283)
"it's old so let's change it"

That's very rarely the thought process in the real world when you're dealing with a production system though. Most developers who have the seniority and experience to make the call to upgrade something aren't just upgrading for the fun of it. It's more like...

"it's old and hundreds of security patches and performance improvements have been released in versions that have come along since it was current, and the core developers aren't supporting this version any more so we're in for a world of hurt if anything goes wrong, and we have the bandwidth to fix this problem right now where we might not in the future so let's change it"

Re:PHP 5 and 7.0 end of life by mtnGoat on Friday July 19, 2019 @12:30PM (#20480055)
"That's very rarely the thought process in the real world when you're dealing with a production system though. Most developers who have the seniority and experience to make the call to upgrade something aren't just upgrading for the fun of it."

you and i's experience varies greatly, Ive worked at a number of firms that update things based solely on age(and boredom) and nothing else... thats what happens when non-tech people steer the ship. I also see this happening a lot to justify someone existence on payroll.

Re:PHP 5 and 7.0 end of life by coldacid on Friday July 19, 2019 @01:37PM (#20480770)
Well there's your problem. Stop working for morons. :D
Re:PHP 5 and 7.0 end of life by mtnGoat on Monday July 29, 2019 @12:31PM (#20556381)
it wasn't always the morons in charge of biz, sometimes it's just bored morons in charge of things. bloat causes this.
Re:PHP 5 and 7.0 end of life by parliament32 on Friday July 19, 2019 @03:07PM (#20481565)
But that sounds exactly what GP is doing, "I am in the process of dockerizing almost everything in sight."

Why do you need Docker to run a WAMP server?

Re:PHP 5 and 7.0 end of life by beatgammit on Saturday July 20, 2019 @11:48AM (#20486432)
You don't need it, but it certainly helps you know what your environment is so you can upgrade/patch one piece at a time without affecting everything. Need a new libc for your database? Feel free to upgrade it without worrying if your webserver or plugins will break. Also, you can more exactly replicate your production environment on your local development machine or replace production if the machine dies.

I love docker for anything where I'm not going to be running whatever is in the repository of whatever Linux distribution I'm running.

Re:PHP 5 and 7.0 end of life by johnchristopher on Saturday July 20, 2019 @12:06PM (#20486529)
That WAMP server is serving multiple virtual hosts. We now need to be able to migrate some services living behind those hosts under different stack versions. Some services are production ready and can be deployed with a more recent LAMP stack but some can't. I don't have an infinite number of servers to put all those services on but I do have the resources for containers.

Reminder: when that WAMP server is down (which is an issue all by itself, the physical server has downtime as well), everything is down. Even static websites.

Re:PHP 5 and 7.0 end of life by cultus on Friday July 19, 2019 @08:28AM (#20478023)
"If it ain't broke don't fix it" is always good advice. But some ancient duct-taped WAMP situation with insecure passwords needs to just be set on fire. Jesus christ, running Windows Server 2003 alone is something he should be fired for if its connected to the internet.
Re:PHP 5 and 7.0 end of life by InvaderFizz on Friday July 19, 2019 @12:28PM (#20480031)
> Jesus christ, running Windows Server 2003 alone is something he should be fired for if its connected to the internet.

Never look under the hood at any of the companies involved in silicon development then. Server 2003 would be an upgrade for many, many tester machines.

To get to the "why dont they update" question:

1. Proprietary hardware with a custom driver.

2. Barely functional proprietary software, good luck getting it to run on anything except Windows XP/95/3.11.

3. The tester is LONG out of support.

4. The company that makes it is either out of business or was bought up by Teradyne/Advantest

5. The software is licensed specifically for that hardware it came with(CPU/Motherboard guids/serials, MAC addresses, etc).

6. If there is even a replacement for the tester, it will cost a minimum of $500k to replace, probably $1MM or more.

7. A customer requirement is to have external access, as much as IT fights it, the tester must also have internet access so the customer can send/receive files with their own workflow.

Sometimes we got lucky and I was able to push forward multiple upgrade projects moving testers from Windows XP to Windows 10. This was the case with most anything using a National Instruments GPIB where the software wasnt also locked down. Since National Instruments makes drives compatible with Windows 10 for their PCI cards, we were able to transition to Windows 10 on an entire floor once I developed a compatibility shim to get around the non-UAC assumptions of the tester software.

Example from 2018: A tester that runs on Windows XP meets all of the above. Capacitors on the P4 motherboard blew up, company was bought by Advantest, but they dont make that tester anymore or even have a replacement. It is one of three left on planet earth. What do we do? Replace everything we can. New RAM, SSD using an IDE to SATA bridge, PSU, etc. We sent the motherboard to one of our internal techs who replaced every single cap on the motherboard, by hand.

A few days later, it is back in action. It will remain in this condition for another decade or more, with internet access. This is normal in anything involved with manufacturing, and yes, it will all end badly. Thankfully, I am out of the Bay Area now and not at all involved with hardware manufacturing or that company, no longer supporting internet connected Windows 3.11, RHEL3, AIX4, and SunOS 2.6 machines.

Re:PHP 5 and 7.0 end of life by cultus on Friday July 19, 2019 @12:45PM (#20480229)
Yikes. I get that there's situations where you can't get newer compatible hardware, etc. But if it's that important, you'd think security would be important enough to go through the trouble of air-gapping it.
Re:PHP 5 and 7.0 end of life by InvaderFizz on Friday July 19, 2019 @01:21PM (#20480619)
It is worse than that, customers run their own workload on these testers using one of two methods:

1. In person.

2. Using VNC/telnet over a SSH gateway that dumps them onto the single broadcast network with all these testers.

Did I mention that changing the IP address on many of the testers is not possible without triggering a $10k+ licensing event because a change in the IP address invalidates the license file?

Re:PHP 5 and 7.0 end of life by ryacko on Friday July 19, 2019 @12:47PM (#20480258)
At $500k wouldn’t be cheaper to reverse engineer it, or even start a clean room reverse engineering project and open source it?
Re:PHP 5 and 7.0 end of life by InvaderFizz on Friday July 19, 2019 @01:14PM (#20480543)
There is a cost-benefit-analysis at play, and even if one makes the security argument, that is "what if" talk, not concrete numbers that are coming out this year.

A $500k tester's depreciation is based on a 10+ year service life. The ones that make it past that point turn into security nightmares and profit centers at the same time.

These are large and complex machines, with hundreds or thousands of moving parts. A competent reverse engineer and driver developer likely could solve many of the driver interface issues and move things to newer platforms, but why invest hundreds of thousands per year in maybe updating something that still works? Who is going to pay for that? Oh, you want to raise your rates to pay for it? I guess they'll move all of their testing development to the competitor in Asia.

This isnt some big name you have heard of, but this is one of the places that all the big names go to to test their silicon during development.

Re:PHP 5 and 7.0 end of life by pritambaral on Friday July 19, 2019 @01:17PM (#20480567)
I guess the idea there is that it will always be cheaper to just not touch anything.
Re:PHP 5 and 7.0 end of life by pbhjpbhj on Friday July 19, 2019 @09:27AM (#20478433)
I'm well in to repairing and longevity, but that 80yo fridge is going to be inefficient and badly thermally insulated I imagine (and if it's electric it's probably hazardous too).

Upgrading isn't just about shiny-shiny, and keeping old stuff isn't always best.

Re:PHP 5 and 7.0 end of life by userbinator on Friday July 19, 2019 @08:04PM (#20483403)
You'd be surprised how efficient they are; give this article a read:

https://www.greenbuildingadvisor.com/article/choosing-an-ene...

What most people consider "old" for a fridge is probably late 70s/early 80s, and those ones did use a lot of power for some reason or other (usually defrost heaters); but the ones much older than that used far less.

I'm restoring it, which does mean rewiring and putting better insulation in the cabinet, but other than that the refrigeration system itself is still original and sealed (that's why they can last almost indefinitely.) If anything, it would likely make it even more efficient.

Re:PHP 5 and 7.0 end of life by pbhjpbhj on Saturday July 20, 2019 @07:07AM (#20485140)
I'd be interested in a quantitative analysis of the power usage. Are you documenting the refurb anywhere?

https://www.thegeoexchange.org/fridge-power-consumption/inde... - shows a saving of two-thirds by replacing a 20yo fridge with a mid-range model (they say they could have saved about 80% power use with a more expensive model).

Re:PHP 5 and 7.0 end of life by userbinator on Saturday July 20, 2019 @02:29PM (#20487458)
I'm not, but someone on YouTube has taken the time to document restoring one of similar vintage:

https://www.youtube.com/watch?v=k_ysVqppaN0

The article you posted shows they went from 1300kWh/yr to 412kWh/yr. Amusing that it says "Some use as little as 255 kwh/year" when the article I posted mentions 244kWh/yr for the 30s Monitor-Top. (Mine is a "flat top" but has a very similar refrigeration system.) Like I said, average power consumption went up after the late 60s/early 70s, but before that they used less.

The compressor in mine draws <100W when running. A quick calculation shows that if it was running 24/7 that would be almost 900kWh/yr, but it definitely won't be running that much --- duty cycles I've found for these old ones vary from 15-20%, giving around 200kWh/yr, still very good. How often you open it and/or put warm things in probably has a higher impact on total power consumption than anything else.

Re:PHP 5 and 7.0 end of life by pbhjpbhj on Sunday July 21, 2019 @01:45PM (#20492558)
Thanks for that.

This is extremely surprising, no. Motor/compressor/refrigerant/insulation design have all improved considerably.

Any insight there?

Usage patterns clearly have an impact, but I doubt they change much for a particular family across models -- some models have little doors for heavy use items to reduce air exchange, compartments probably make a big difference ('glass' shelves instead of wire).

Interesting. /beardStroke

Re:PHP 5 and 7.0 end of life by userbinator on Sunday July 21, 2019 @09:19PM (#20494759)
Apart from improved insulation I don't think there's been much in the way of improvements since the late 30s --- if you look at the hermetic systems, they haven't changed much in decades.

In fact, the newer "environmentally friendly" refrigerants are less efficient than CFCs... so it's sort of a tradeoff between risking more ozone depletion when they leak, or putting more CO2 into the atmosphere from the higher power consumption...

Re:PHP 5 and 7.0 end of life by snowwrestler on Friday July 19, 2019 @12:20PM (#20479932)
Basic maintenance is not trend-chasing. Keeping your software up to date on a web-facing server is basic maintenance.

If you don't update your software regularly, then future updates get harder and harder. Unfortunately, future updates might include security patches that are critical. At that point your choices are both bad: do a major catch-up update under crisis mode, or decline the update and roll the dice on a security incident (which will put you into crisis mode if if happens).

Incremental LAMP stack updates are so easy... they rarely break things, and there are so many other people doing the same thing, there is tons of community advice and help. If a developer is not capable of doing that, what ARE they capable of doing?

Re:PHP 5 and 7.0 end of life by scolson on Friday July 19, 2019 @09:18AM (#20478369)
FWIW, I think the concern with "doesn't bother updating the passwords" was with respect to recovering from a hacked joomla install, not about an aging password management scheme.
Re:PHP 5 and 7.0 end of life by johnchristopher on Friday July 19, 2019 @02:56PM (#20481479)
I agree with you, don't fix what ain't broken, etc.

I won't get into details but the thing isn't stable and the last hack brought down some part of an emergency infrastructure for a whole region of a small country.

So, yeah... not stable, not safe.

Re:PHP 5 and 7.0 end of life by wishinghand on Friday July 19, 2019 @05:24PM (#20482574)
Just going to gloss over using PHP 5.4?