October 30, 2006
Security Questions

[initial posting moved from Security] Helmut, Greetings from Jerusalem. I introduced a peace activist here to ProWiki. They were immediately interested because of security issues, which is to say, they want a hacker proof site, as much as possible. Their previous bulletin boards were based on PHP and were all hacked by belligerents. They think that Perl in a cgi-bin would be much more secure. Could you please verify this? I share their letter, anonymous for now. Thank you! AndriusKulikauskas October 30, 2006 10:25 CET

Question: "Is Perl more secure than PHP?"

Answer: I don't think that PHP or Perl are secure or insecure as systems, it matters very much how you use them. Perl seems to have fewer problems than PHP but maybe this is only because Perl is used by programmers primarily. I assume that programmers are less sloppy with security issues statistically. -- HelmutLeitner

Q: Have there been security issues in the past and have they been resolved?

A: No, up to now there have been no security issues.

Q: Is ProWiki vulnerable to spamming by scripts?

A: ProWiki has a number of simple spam defense features which seem to be sufficiently effective.

Q2: Like what for example?

A2: FolderSpam contains pages about that: block IPs, require a user name, restrict what anonymous users (Visitors) can do when editing.

Q: Is ProWiki vulnerable to DNS attacks by scripts (grabbing logins or another feature so the server is jammed up and has no processing time left)?

A: The ProWiki script has SlurpBlocking which tries to minimize the effects of such attacks but it's still blocking in the script, so the script is called. For severe attacks it may be necessary to block earlier, on the level of Apache, (x)inetd, or even Router. Up to now we had no need to fight attacks on these levels.

Q: Is the password/username store encrypted and safe?

A: The user data and password is stored in the GlobalDir directory. Directory and files are protected by the Unix permission system. The password is currently unencrypted. PasswordEncryption is planned, but not yet implemented.

Q: can it be "hacked" and wiped out either by scripts or hackers?

A: We had no such problem up to now. But no guarantee can be given. This is also not a wiki issue primarily: if someone can hack a server and get root access (it could be enough to have a weak password like "tennis" with a root account) then he can do any harm there.