Proposal for new forum

keith73

Greetings,

I have been a member of several mailing lists and often see posts about vulnerabilities found in some very popular php apps such as php-nuke and some others.

I thought it might be a good idea to have another forum on this site that dealt with security issues. many newbies aren't advanced enough in their skills to consider security and often overlook it. even some of us veterans may not know all of the pitfalls of our php apps.

Anyone second that motion??

WOOPS! that second option should be NO, not know. pardon my blunder.

keith

planetsim

Although i do agree it would be nice, security shouldnt have its own little seperate forum. security is too wide and with it will produce members asking topics which have all ready risen before.

vaska

yeah, i'm not sure it needs a separate forum for that...it's easy enough to break it down and ask the funky question straight up...

however, i would happily go for a forum dedicated to mexican (tex-mex) food of which i can not find any of on the continent known as "europe"...

planetsim

btw i should add, most of the stickied threads do hold some Security information or good coding which is secure.

Merve

I think it is a good idea, but not enough people ask security related questions...

Moonglobe

maybe they would with a new forum 😉

LordShryku

I'm for it. Even with the caveat of "Nothing is completly hack-proof", I'm sure we could all learn more about security of our apps.

Merve

I would love to learn a little bit about security. One common thing that not enough people do is suppress the errors of mysql functions. The errors should be suppressed and custom error messages should be created, otherwise mysql may spew out info that hackers can use to their advantage...

A security forum would be a good idea, but I think that most security-related questions could be asked in the Newbies, General Help, or Coding forums...I would love to see this forum, but realistically, I don't think it'll happen....

LordShryku

Originally posted by Merve
One common thing that not enough people do is suppress the errors of mysql functions. The errors should be suppressed and custom error messages should be created, otherwise mysql may spew out info that hackers can use to their advantage...

Ideally, in a production enviroment, you should have display_errors set to Off, and use log_errors instead. Of course, this does require you to write all of your own error handling though.

keith73

Originally posted by LordShryku
Ideally, in a production enviroment, you should have display_errors set to Off, and use log_errors instead. Of course, this does require you to write all of your own error handling though.

I write my own error handling anyway.
all of my mysql errors are customized and go into a file and php errors can get saved to a logfile or stored in the apache error log.

keith

planetsim

Originally posted by Moonglobe
maybe they would with a new forum 😉

Yes of course they would but at the end of the day you will notice that most users wont search the forums to make sure it hasnt already come up.

jebster

Originally posted by planetsim
Yes of course they would but at the end of the day you will notice that most users wont search the forums to make sure it hasnt already come up.

So, new forum or not they will still do that! :p

drawmack

Generally, if I see a major security problem with something posted anywhere I point it out to the person. Then a huge debate follows about weather or not it is an issue, followed by many ways to seal up the issue. If we had a forum just for security issues it would discourage this and I don't feel that is a good thing.

piersk

It's all very well posting this thread here, but wouldn't it have been a better idea to post it here