Re: PHP as a secure language? PHP worms? [was: Re: new linux malware]

["Thomas M. Payerle" <payerle () physics umd edu>]

> > 1. PHP is the "serious" or at least open-source/Linux/security freak's 
> > choice for web development. Mine as well (although as many still say, Perl 
> > does a better job).
While PHP is extremely popular, especially in open-source and Linux communities,I am not sure it qualifies as the defacto choice 
of "serious" web developers.
And I did not think it was as popular in the security community (when I 
occasionally scan one of the reports on the frequent PHP based applications
that grace this list, I thought exploit code is as often as not given in 
Perl:)
> > 2. Developing secure applications in PHP is difficult, as one of PHP's 
> > creators said recently - even to him after years of trying.
The number of PHP applications getting reported on bugtraq would seem to
support this, although likely also contributed to the fact that it is popular,
and perhaps that it is (or at least has the reputation of being) of being 
easy to program, leading to programs written by people without understanding
of security implications.

My personal knowledge of PHP is somewhat meager, but having had to install
it recently for a developer I find the philosophy of the PHP security options
to be somewhat odd.  It almost seemed like the emphasis was on distrusting
the programmer rather than the person running the program.  I think it would
strongly benefit from the Perlish concept of data tainting.
> > 3. Staying on top of new PHP vulnerabilities has become impossible, popping 
> > around everywhere.
While I concede I am less than happy about the frequency with which patched
versions of php come out, and most versions include some security related
patches, I do not think it is impossible.  Furthermore, most of the "security"
patches have been rather localized, and affect only a small number of functions
and often only in rather specific circumstances, and with some knowledge of the
PHP applications running on your system you can often leap frog over some
of the versions.

Most bugtraq messages with PHP in the subject appear to be holes in specific 
applications, usually due to programming errors on the part of the application
author.  This does not mean the language is inherently insecure; although it
may indicate that it is difficult to write secure PHP code.  It could also
mean that PHP is easy enough to program that a lot of people without knowledge
of how to program securely are writing PHP code.

Tom Payerle 
Dept of Physics				payerle () physics umd edu
University of Maryland                  (301) 405-6973
College Park, MD 20742-4111             Fax: (301) 314-9525