Drupal Answers

@Mołot Did do you tell though? We'll probably be doing a big audit next week (still up to management to decide to set aside the time for it), but there's a lot of potential for armageddon to lie dormant for a while.

Mołot

@Letharion We upgraded stage and replaced live with satge's copy

Unless someone inside did something, we are safe

There was no important content changes in the meantime, so we could afford it

Letharion

@Mołot Ah, nice situation.

Mołot

I'm glad, too

Audit is good thing, but... better not to need

Letharion

@Mołot A lot better, indeed.

Mołot

My admins hate me and my "make snapshots, please" or "Why migrating DB is so slow? Yes, yes I needed to do it again"

;)

Letharion

2:40 PM

Slightly different topic: Someone I know does a lot of hosting, and I know a particular server that still hasn't upgraded bash for shellshock, despite my reminder. That's Armageddon just waiting to happen right there.

Mołot

Any way to kick it's admins?

I mean, if you break into VPS, you can DoS other mashines in the same infrastructure a lot easier...

Letharion

@Mołot One man operation mostly. Short of trying to get myself root access, I've done what I can. Though considering the apparent state of things, maybe getting root access wouldn't be difficult ;)

Mołot

LOL

Yea, once upon a time I did something similar

It wasn't even breaking id, doors was wide open ;) There was this internet shop that opened login form by default

admin:admin

worked :/

Letharion

Ha. I've seen similar horror stories where people don't understand why keeping all the login logic in JS would be a bad idea.

Mołot

Wow

just... wow

But there was this guy on Drupal Answers who wanted to test if page was accessed legitimately by testing referer

and didn't want to believe me when I told him that referer is whatever user sets it to, if user cares, of course, so this is not the best method

Letharion

2:48 PM

I thought I read it on coding horror, but I can't find it now... shame.
Haha, that's fantastic.

Mołot

Fun how http header is referer when English word is referrer.

well, at least it make it clear that referer is not a real referrer ;p

Letharion

Never though about, but wikipedia has short note about it I see: en.wikipedia.org/wiki/HTTP_referer

Mołot

Well I'm "almost dyslexic", I need to think what I'm writing all the time, so I notice thingsl ike that

Letharion

@Mołot You familiar with Dunning-Kruger effect?
I often think of that when I see beginners thinking they've "solved" the security problem in a "new" way. Such as looking at the referer-header.

It's hopeful though that people actually do research on the topic and we might collectively become less ignorant of our own shortcomings one day.

Mołot

3:04 PM

Wait a minute

I'm reading Wikipedia entry for Dunning-Kruger

Letharion

I haven't read the WP article (though I used it to check my spelling ;) ) but this article is written by Dunning himself: psmag.com/navigation/health-and-behavior/confident-idiots-92793 "Where all confident idiots", and it's fascinating.

Mołot

Oh, thank you

Well,

it's easy to think less about what you know

when you know how much you don't know ;)

And more you know, more questions :)

Mołot

3:34 PM

@Letharion gotta go, have a calm weekend

Letharion

@Mołot Enjoy the beer!

Mołot