This topic just came up in a thread here. I'd bet the #1 reason many people are considering switching to CPGNuke is it's reputation for security with its speed being a distant second. Not that speed isn't important but 99% of websites don't have the load to make it show as an advantage. My question is whether CPGNuke relies on the security of its modules or does it have built in code that protects us from bad stuff ala Sentinel, Protector etc.? For instance if we say CPGNuke doesn't have to worry about SQL injections is that because all modules use libraries/API's that are covered from this, or could a poorly programmed module open our CPGNuke sites wide? In the case above Phoenix was good enough to point out the shortcomings of a specific module. My concern is that there is tons of module code being released every day and I imagine that the core developers don't have the time to go through it all.

This being the case, would it be advantageous to have a Sentinel/Protector like system to protect users from modules coded by inexperienced developers? It'd be nice to have a list of modules that if you stick with them you don't need extra protection. Right now I imagine that list excludes any of the dozens of modules not currently in CVS. For those of us running these non-CVS modules is an extra security system, like Sentinel, or Protector necessary?

If CPGNuke does depend on the coding level of its modules and every module hasn't been examined by developers that know what is cool and what isn't, a poll of who uses non-CVS modules may help determine the need for a CPGNuke security system.

Thoughts?

I don't know if DF has it, but maybe something like this.

In your header.php file:

PHP:

include ('protector.php');

and then in protector.php:

PHP:

Maybe?

Luke

There is a certified secure program that has begun to do some of this. I don't know how much they've done or if every module currently in the dragonfly downloads section has been checked. I would hope they are though because what if an insecure module found through dragonfly downloads caused a site to be compromised.

I'd like to know exactly which modules have at least been looked over and not just thrown into the downloads section for quantity.

all we woud need to do would be to add my code above to the header file, as all modules call header and this should make all modules secure. I think

Luke

Dragonfly doesn't use protector cos few protection is already in code like UNION.

I know the module checking has been started kinda cause phoenix removed one for security reasons. I understand what you're saying ronin, I think we need one of the devs to respond to this one since they are closest with the code

Which module if I may ask? Also I do have concerns about the Zina module. Can someone from the security team take a look at it or confirm it's ok. I checked it out and at first glance I saw some linux and IIS command line capability which concerned me. I don't know if it works or not but that might be worth the security teams time to look into.

it was the nukeC that was being ported

It's the responsibility of the module creator to work within dragonfly's standards to make there modules 'secure'.. having the core developers check evey module takes time away from other priorities.. It is also the job or a webmaster to know what code they are running on there machines.. you should inspect all code yourself, and even test locally before running on a production site.

It's the responsibility of the module creator to work within dragonfly's standards to make there modules 'secure'.. having the core developers check evey module takes time away from other priorities.. It is also the job or a webmaster to know what code they are running on there machines.. you should inspect all code yourself, and even test locally before running on a production site.

I do check all modules but some are just too complex for me know if they are absolutely secure.

I'm sure there are a lot of admins out there that aren't as good as I am and can't make heads or tails out of secure code vs a rubber hose. So it should be up to someone to check this stuff out and give it the thumbs up. They don't have to fix anything just look it over and give it a check mark or an x for public downloading. What if there was a module creator that created a module simply for malicious intent. Then submitted it to the downloads section and hundreds of people download it. There has to be some form of checking going on.

The subject is under discussion with a view to providing certain minumum standards that must be met, and we will try to assess as we go along. In the interim, programs that are grossly out of order will simply be deleted from our system, as we come across them.

Protector/Sentinel cannot provide anything, protection wise, that Dragonfly does not already have covered inherently. They could not protect the shortcomings in the module I deleted.

Phoenix wrote:

Protector/Sentinel cannot provide anything, protection wise, that Dragonfly does not already have covered inherently. They could not protect the shortcomings in the module I deleted.

Excellent!! I wasn't sure about this, but if DF already has all of the protection a system like Protector or Sentinel brings to the table then that makes me, and I'm sure lots of others, happy. This should cover many of the issues an inexperienced developer may insert in a module right? Granted not the ones you saw Phoenix, but many others?

I've been waiting to switch my site to DF for months now. I may just go ahead anyway but I'd be losing a lot of cool features that non CVS modules bring to the table. This appears to be the big decision a webmaster makes when making the decision to switch to a more secure CMS like DF. Features vs. Security.

Thanks for the great feedback folks.

Head-e wrote:

It is also the job or a webmaster to know what code they are running on there machines.. you should inspect all code yourself, and even test locally before running on a production site.

If that were true I imagine the use of Dragonfly as a CMS would drop significantly. I know what you are saying but I figure the reason these CMS' exist and are used is so that everyone doesn't have to do this.

djdevon3 wrote:

What if there was a module creator that created a module simply for malicious intent. Then submitted it to the downloads section and hundreds of people download it. There has to be some form of checking going on.

You can take this even further djdevon3. The DF modules/blocks forum is full of links to download sections on other sites, not this one. So the module wouldn't even have to be located here but hundreds of people would still download and install it if mentioned/discussed here.

Thats what I like about Sentinel. It gives me an extra level of security in case any of the myriad of module developers isn't aware of a particular security issue. It's obviously not bulletproof but it helps as the script kiddies seem to focus on the ones that are covered.

That's why it warms my heart after hearing from Phoenix that DF contains all the inherent protection from insecure modules that a Sentinel like system brings to the table.