Thesis integrates with Wordpress, it is not derivative from it. Same way Linux modules integrate with the Linux kernel (and many of them are closed source).
If someone is using a public/open API, and not distributing any part of the software, it means they are not based on the other.
You know, lots of people talk about using keys instead of passwords... By doing that if you box is compromised, the attacker will get access to ALL your boxes.
So, the best option is to use an encrypted ssh key (so you have the type the pass everytime) or a good/different password for every box.
Good job researching those pesky brute force scans. Is there anyway you can post the complete list with all the data collected instead of just the top 50?
I expected a scan to go through the site looking at every possible bug, not just that 200/300 checks.
Looking at the full disclosure archives, lots of users mentioned that it is actually common for web scans to be that simple. I guess the technology is still new and most people don't care (as long as the result is a BIG GREEN - no bugs found).
I agree with you. But beginners need to learn from somewhere and most advanced programmers are busy at work and not writing articles :)
Plus, did you ever read a PHP book? Most of them give bad examples and bad code practices too... I just read one that said to disable all apache logging (including error logging) for performance reasons.
The reason they write poor code is because they are beginners and beginners always make mistakes, use functions incorrectly, etc. In any language they code, not just PHP.
PHP is often more visible because it is more used and easier to write... But if PHP wasn't that popular, we would see the same issue with Perl, Python, etc.
Interesting discussion in there, but I think the PHP guys are right on this one. You should never rely on undefined behavior of any API for mission critical code.
Always use what is documented so you don't have to cry later..
Most people who post anonymously are afraid of doing something wrong (or saying something stupid) and losing respect for that. Either that, or they are trolls.
But thanks for the tip. I will update my HN profile and hope to do not say stupid things :)