ddbb

Much needed for WP :) But I am biased, since I helped with this work...

To summarize:

Thesis integrates with Wordpress, it is not derivative from it. Same way Linux modules integrate with the Linux kernel (and many of them are closed source).

If someone is using a public/open API, and not distributing any part of the software, it means they are not based on the other.

http://sucuri.net is a good one :) (by fellow HN members)

You know, lots of people talk about using keys instead of passwords... By doing that if you box is compromised, the attacker will get access to ALL your boxes.

So, the best option is to use an encrypted ssh key (so you have the type the pass everytime) or a good/different password for every box.

Make sense... I was just looking at the bottom and couldn't find your answer :)

Good job researching those pesky brute force scans. Is there anyway you can post the complete list with all the data collected instead of just the top 50?

You mean at the top?

That is what I love about PHP... Always making my life easier.

I was going to say the same thing...

I expected a scan to go through the site looking at every possible bug, not just that 200/300 checks.

Looking at the full disclosure archives, lots of users mentioned that it is actually common for web scans to be that simple. I guess the technology is still new and most people don't care (as long as the result is a BIG GREEN - no bugs found).

I agree with you. But beginners need to learn from somewhere and most advanced programmers are busy at work and not writing articles :)

Plus, did you ever read a PHP book? Most of them give bad examples and bad code practices too... I just read one that said to disable all apache logging (including error logging) for performance reasons.

The reason they write poor code is because they are beginners and beginners always make mistakes, use functions incorrectly, etc. In any language they code, not just PHP.

PHP is often more visible because it is more used and easier to write... But if PHP wasn't that popular, we would see the same issue with Perl, Python, etc.

Interesting discussion in there, but I think the PHP guys are right on this one. You should never rely on undefined behavior of any API for mission critical code.

Always use what is documented so you don't have to cry later..

Some details in here too:

http://blog.sucuri.net/2009/12/twitter-defacement.html

Seems a DNS hijacking for sure.

Some details in here too:

http://blog.sucuri.net/2009/12/twitter-defacement.html

Using OSSEC (open source).

Seriously, it puts rkhunter, logcheck and all these old tools in their toes..

Check http://www.ossec.net

It monitors your logs, file changes, etc all by default, simple to install, etc.. I love it.

Good stuff, but you need to add OAuth in there... Not everyone likes to post their twitter pass onto other sites.

Who says it was a 0-day attack? Looking at the output,it seems they brute force the password of user adam...

So yes, even the pros sometimes can make mistake.