Why I don't fear the Zend Framework

Sunday, November 13. 2005

Until today there have been a lot of blog postings about the Zend Framework. People love or hate it for their own special reasons. I personally think that everyone who works on it should really consider what he does by signing the CLA and working on it. The message he gives is, that Zend is right in communicating the Zend Framework as a must, because all other frameworks are by definition bad and untrustworthy, because they are only developed by a bunch of open source geeks and there is no company in control. I seriously dislike this kind of message, because it is simply not true. I have released lots of security advisories and dealt with lots of vendors during the last 6 years. The worst security contacts were either when the project was developed by 16 year olds or when there was a company behind the project. These companies usually consider security holes as very bad publicity and always try to downplay the impact.

On the other hand one must see what a framework, which is used everywhere means for security researchers like me. When a common framework is used, this is a single point of failure for tons of web applications. A security hole in the framework will expose a large number of servers at the same time. We have recently seen how a flaw in PHP ($GLOBALS) put PEAR.php at risk and with it everything that is build around it. When everyone is using the Zend Framework, this also means, that the bad guys have a single attack vector to concentrate their power on.

The good thing from an attacker's point of view is, that the whole security of the Zend Framework will most probably rely on the skills of Chris 'not really an international recognised expert in the field of PHP Security and no PHP core developer at all' Shiflett. As long Zend continues to rely on his services, no serious security researcher will join their team and so long there will be no real security in the Zend Framework.

Posted by Stefan Esser in Security, PHP at 12:40

Comments (16)

Link to this post

Comments

Display comments as (Linear | Threaded)

#1 Stefan Esser ()

If you only dare to comment as Anonymous Coward, from some anonymous place like an internet cafe, then please don't waste your energy, I will delete your comments.

The blog posting as usual contains of facts.

posted on Sunday, November 13. 2005

#2 Ivo Jansch wrote (Link) ()

> When a common framework is used, this is a single point of failure for
> tons of web applications. A security hole in the framework will
> expose a large number of servers at the same time.

This works both ways. It is also a single point to fix, and also a single point that gets a lot more review than hundreds of different lines of code spread throughout numerous applications.

In my opinion, a framework doesn't necessarily give you a single point that could potentially be a problem, but instead gives you a single point to devote your energy to, thus strengthening it more than stuff without such 'single points'.

P.S. why the flame about Chris? If you feel the need to publicly criticise someone, at least use arguments.

posted on Sunday, November 13. 2005

#2.1 Stefan Esser ()

Maybe you ask Mr. Shiflett why he let himself be interviewed as representant of the PHP core developers? He is no core developer. He only has an account to the PHP doc tree, where his last commit is about 3 years ago.

The same for security. He claims on his own page that he is an international recognised expert in the field of PHP security. When you read what he writes you will find among several errors nothing new. Everything can be found in talks of other persons.

posted on Sunday, November 13. 2005

#2.2 Stefan Esser ()

Oh and maybe you ask Mr. Shiflett why he has removed the link to http://www.hardened-php.net from phpsec.org the moment we offered auditing services. Simply because he does not want that anyone elses auditing service is used beside brainblub.

posted on Sunday, November 13. 2005

#2.2.1 David Rodger ()

I don't care that you take issue with Chris Shiflett on security matters. To rationally argue these matters furthers the debate helps us all.

I just don't understand why you have to be so fucking nasty about it (and him).

posted on Sunday, November 13. 2005

#3 Chris Shiflett wrote (Link) ()

Note: I'll reply to Stefan's personal attacks, but I don't intend to indulge him beyond this. I'm disappointed by his consistent lack of professionalism.

> Maybe you ask Mr. Shiflett why he let himself be interviewed as
> representant of the PHP core developers?

1. I've never represented myself as a core PHP developer. In fact, I challenge you to ever find anyone who uses the phrase "core PHP developer" or "PHP core developer" in association with my name.

2. There are many people who are not core PHP developers who contribute positively to the PHP community.

> He claims on his own page that he is an international recognised
> expert in the field of PHP security.

1. My biography was written for me.

2. I focus on helping people. It was never my intention to be well-known, and it is not my fault that you are not.

> When you read what he writes you will find among several errors
> nothing new. Everything can be found in talks of other persons.

1. If you really do know of errors, you should inform me rather than make unsubstantiated claims.

2. Many people who speak about PHP security borrow content from me with my permission. It's no coincidence that these talks have some of the same information.

> Oh and maybe you ask Mr. Shiflett why he has removed the link to
> http://www.hardened-php.net from phpsec.org the moment we offered
> auditing services.

1. Your project is linked from the front page and has been for several months.

2. We have never linked to your auditing services. I offered to do exactly that, but your unprofessional behavior shortly thereafter made me rethink my offer.

3. The PHPSC library is an open library of links to which any member can add (automatically). I don't plan to help someone whose primary interest seems to be self-promotion, but you don't have to convince me - any member of the PHPSC can add a link to your services.

If you can clean up your behavior, I'll pay attention to you. Until then, I have better things to do.

posted on Sunday, November 13. 2005

#3.1 Stefan Esser ()

> 1. I've never represented myself as a core PHP developer. In fact, I
> challenge you to ever find anyone who uses the phrase "core PHP
> developer" or "PHP core developer" in association with my name.

http://www.oetrends.com/news.php?action=view_record&idnum=483

"Chris Shiflett, a vocal PHP dev, author, advocate, has been invited by Zend to join the PHP Framework project, and to help represent the core developer interests and needs."

Do I smell the word "core developer" or don't I smell it...

> 2. I focus on helping people. It was never my intention to be
> well-known, and it is not my fault that you are not.

I invite you to enter your name and my name into f.e. google the results speak for themself. You are a bit megalomanic.

> 2. We have never linked to your auditing services. I offered to do
> exactly that, but your unprofessional behavior shortly thereafter
> made me rethink my offer.

You removed us from your library when we started offering services. You have us on your front page to make it look like our work has anything todo with your crappy consortium.

> 3. The PHPSC library is an open library of links to which any
> member can add (automatically). I don't plan to help someone
> whose primary interest seems to be self-promotion,
> but you don't have to convince me - any member of the
> PHPSC can add a link to your services.

This joke actually made my day. Calling me self-promoting. Out of your mouth... LOL...