Re:Pro-security? Stay away from these hosters
by dolfje on Wednesday July 29, 2015 @04:12AM
(#9967010)
To clarify, when we say outdated PHP 5.3, we only mean the standalone PHP version. When an ubuntu version was detected, it was correctly marked as maintained. So all these hosters use 5.3 without package managers.
[ Parent
| on HN ]
Re:Pro-security? Stay away from these hosters
by kijin on Wednesday July 29, 2015 @04:19AM
(#9967043)
That sounds much better. Please clarify it in the article so as not to spread FUD.
It would also be helpful to release a table of the exact versions you found, instead of merely linking to their websites. Those who are still running PHP 5.2 deserve to be shamed even more!
Re:Pro-security? Stay away from these hosters
by dspillett on Wednesday July 29, 2015 @04:53AM
(#9967188)
How are you scanning to detect the OS version though? And verifying if PHP came from a package or a separate compile? Some hosts deliberately fuzz external indications of the base OS so you'd need an account to log into to properly check this, and they could have a compile from source version of PHP due to install procedures that date back before major updates to the base OS (and were updated "the wrong way"). Your effort is laudable (I'm all for naming and shaming the insecure) but you are open to false positives which could cause you legal issues.
Re:Pro-security? Stay away from these hosters
by dolfje on Wednesday July 29, 2015 @06:05AM
(#9967521)
By using multiple versions of multiple software, you can determine the false positives. There are little servers that deliberately fuzz external in a consistent way of all software found. Mostly they only do PHP or Apache, but forget OpenSSH. If there is a hoster doing it in consistent way and ended on our shame list. Please stand up, you deserve a full new blog post about how it should be done.