Hacker News Reader

Comment by wldlyinaccurate | Hacker News Reader

vBulletin is (and always has been) terribly insecure. Only way to beef up security is to lock down admin panels, e.g. IP-restrict them.

View on HN

They are testing a discourse instance: http://ubuntu-discourse.org/

Since Discourse is fully open source under GPL v2 anyone can validate its security (or lack thereof) at will on GitHub. And it is not written in PHP.

vB's biggest problem is that it's a horribly convoluted rat's nest. If you've ever seen the actual code, you can see why it's just not possible to lockdown everything since there's so much legacy code that would break as a result.

To my knowledge, that's sadly true of any PHP based message board (phpBB, SMF, etc).

I think this is very much a cultural problem within the PHP community. phpBB in particular is notorious for its unsustainable code and I think I figured out the reasons.

There are better ways of doing things (despite PHP's inherent warts) that some other projects have used quite successfully, and more importantly sustainably, but there's a very long history of doing things "because that's just the way it's always been done" and I don't see that changing anytime soon, I'm afraid.

I mean if you look at some of the tutorials out there, a lot of it is just appalling in terms of maintainability, efficiency and security (and that includes some very popular frameworks). There are a lot of cases where short-term, and often short-sighted, convenience trumps long-term goals.

I can remember setting up a osCommerce site years ago, and the _official_ way of installing 'extensions' was literally to follow instructions telling you to open XYZ file and add this code at this line number, etc.

Sounds like a call to action to me. Sooner than later someone needs to make a PHP based forum that isn't crap.

I've yet to see a single, practical, simple end-to-end tutorial published for free (like the vast majority of the "rubbish" ones) that even uses SPL. Of course, I see snippets here and there of the iterator et al. But nothing comprehensive.

Forget a full on forum, if someone took the time to use best practices to build a MVC/P app as a reference, there would be plenty adopters. I don't mean something that "hides" work, I.E. A framework like Code Igniter. These just introduce more magic into code that doesn't actually teach the why and how.

Already done: http://vanillaforums.org/

There have been a number of attempts at that. Unfortunately, most of them seem to also try to solve the problems of "PHP based" and "forum".

I think XenForo uses bcrypt: http://xenforo.com/

Xenforo overall takes security more seriously than phpBB, vBulletin, and IPB, possibly because they don't have as much legacy cruft to worry about.

For instance, vBulletin knows about (and doesn't plan to fix) a vulnerability that allows any moderator to privilege escalate to take over a server (and steal passwords) under default settings. They don't consider it a big deal because moderators should be considered trusted users.

Unfortunately, it's significantly harder to ensure that every moderator won't get their password stolen than it is to ensure that every admin won't get their password stolen. Recently, @rootinabox exploited that (and possibly other vulnerabilities) to hack a bunch of Pokemon sites that were running vBulletin.

Can you expand on how it's terribly insecure? Curious.

He can't.

Sorry for the late reply. There's no single reason for it being so insecure, but you don't need to search for long to find vulnerabilities.

I think the main problem comes from the fact that much of the code still resembles the spaghetti that was written over 10 years ago. Even recent versions have problems with basic input sanitization, which makes injection attacks really easy. Social engineering is also a massive problem: if you can phish an admin login, you can essentially take over the entire web server because the admin panel is just too powerful.

Reply on news.ycombinator.com