I sent this to the docs list when they started considering Zikula. Now that we're setting up a test instance and getting some people on the infrastructure team to work on it it seems like a good point in time to forward it here.
-------- Original Message -------- Date: Fri, 23 Jan 2009 16:55:03 -0800 From: Toshio Kuratomi a.badger@gmail.com To: fedora-docs-list@redhat.com
Paul W. Frields wrote:
I think we should also be considering the other major players in the CMS game, if there are people available to deploy and maintain them. Drupal and Joomla! immediately come to mind, the latter especially because it actually has some DocBook XML support. Features aren't particularly compelling, though, if we have no one around to help with the maintenance.
One of the things I didn't know until I did some browsing around their website is that Zikula started off as PostNuke but that they changed the name in June. So they are a long term player in the CMS market.
None of this has any bearing on the quality of Zikula, which I'm sure is excellent.
I was impressed by a few of the things I've learned since this morning :-) The answers to how proactive the security is was a nice change from the usual thoughts I've seen:: https://fedoraproject.org/wiki/Zikula_IRC_Chat_Interview#t12:20
Here's my naive search of cve.mitre.org for issues reported in 2008. Note that some people would say to exclude plugins from this but my view is that we're going to be running plugins as part of our deployment and we'll want to know if we can expand our capabilities by pulling in functionality via plugins without compromising security. So knowing this does a *little* towards understanding whether the Core provides an API for writing secure plugins and the plugin community is security minded as well as Core developers. And like I say, this is naive :-)
91 Joomla -- Lots of plugins a few in core 79 Drupal -- Lots of plugins a few in core 60 Wordpress -- Lots of plugins, a few in core 53 Mambo --Lots of plugins, at least one in core 4 zikula + postnuke -- 1 in Core, 3 in plugins 1 midgard 0 zikula 0 enano
For reference, mediawiki, which we think has an acceptable security-to-benefit ratio had 8 vulnerabilities reported in 2008 using the same naive count.
-Toshio
2009/1/29 Toshio Kuratomi a.badger@gmail.com:
I sent this to the docs list when they started considering Zikula. Now that we're setting up a test instance and getting some people on the infrastructure team to work on it it seems like a good point in time to forward it here.
-------- Original Message -------- Date: Fri, 23 Jan 2009 16:55:03 -0800 From: Toshio Kuratomi a.badger@gmail.com To: fedora-docs-list@redhat.com
Paul W. Frields wrote:
I think we should also be considering the other major players in the CMS game, if there are people available to deploy and maintain them. Drupal and Joomla! immediately come to mind, the latter especially because it actually has some DocBook XML support. Features aren't particularly compelling, though, if we have no one around to help with the maintenance.
One of the things I didn't know until I did some browsing around their website is that Zikula started off as PostNuke but that they changed the name in June. So they are a long term player in the CMS market.
None of this has any bearing on the quality of Zikula, which I'm sure is excellent.
I was impressed by a few of the things I've learned since this morning :-) The answers to how proactive the security is was a nice change from the usual thoughts I've seen:: https://fedoraproject.org/wiki/Zikula_IRC_Chat_Interview#t12:20
Here's my naive search of cve.mitre.org for issues reported in 2008. Note that some people would say to exclude plugins from this but my view is that we're going to be running plugins as part of our deployment and we'll want to know if we can expand our capabilities by pulling in functionality via plugins without compromising security. So knowing this does a *little* towards understanding whether the Core provides an API for writing secure plugins and the plugin community is security minded as well as Core developers. And like I say, this is naive :-)
91 Joomla -- Lots of plugins a few in core 79 Drupal -- Lots of plugins a few in core 60 Wordpress -- Lots of plugins, a few in core 53 Mambo --Lots of plugins, at least one in core 4 zikula + postnuke -- 1 in Core, 3 in plugins
That sounds awfully low for Postnuke. Doing a quick google search of postnuke security fixes and just looking at different releases.. there should be about 20 with some amount in core and a lot in plugins. My information about the current state of PostNuke is not good. I am betting that they are doing a lot more for security but a number of 4 problems just was too low for the amount of systems I have had to 'clean' since 2002.
Stephen John Smoogen wrote:
2009/1/29 Toshio Kuratomi a.badger@gmail.com:
I sent this to the docs list when they started considering Zikula. Now that we're setting up a test instance and getting some people on the infrastructure team to work on it it seems like a good point in time to forward it here.
-------- Original Message -------- Date: Fri, 23 Jan 2009 16:55:03 -0800 From: Toshio Kuratomi a.badger@gmail.com To: fedora-docs-list@redhat.com
Paul W. Frields wrote:
I think we should also be considering the other major players in the CMS game, if there are people available to deploy and maintain them. Drupal and Joomla! immediately come to mind, the latter especially because it actually has some DocBook XML support. Features aren't particularly compelling, though, if we have no one around to help with the maintenance.
One of the things I didn't know until I did some browsing around their website is that Zikula started off as PostNuke but that they changed the name in June. So they are a long term player in the CMS market.
None of this has any bearing on the quality of Zikula, which I'm sure is excellent.
I was impressed by a few of the things I've learned since this morning :-) The answers to how proactive the security is was a nice change from the usual thoughts I've seen:: https://fedoraproject.org/wiki/Zikula_IRC_Chat_Interview#t12:20
Here's my naive search of cve.mitre.org for issues reported in 2008. Note that some people would say to exclude plugins from this but my view is that we're going to be running plugins as part of our deployment and we'll want to know if we can expand our capabilities by pulling in functionality via plugins without compromising security. So knowing this does a *little* towards understanding whether the Core provides an API for writing secure plugins and the plugin community is security minded as well as Core developers. And like I say, this is naive :-)
91 Joomla -- Lots of plugins a few in core 79 Drupal -- Lots of plugins a few in core 60 Wordpress -- Lots of plugins, a few in core 53 Mambo --Lots of plugins, at least one in core 4 zikula + postnuke -- 1 in Core, 3 in plugins
That sounds awfully low for Postnuke. Doing a quick google search of postnuke security fixes and just looking at different releases.. there should be about 20 with some amount in core and a lot in plugins. My information about the current state of PostNuke is not good. I am betting that they are doing a lot more for security but a number of 4 problems just was too low for the amount of systems I have had to 'clean' since 2002.
Is that 20 for 2008?
-Toshio
On Thu, 29 Jan 2009, Stephen John Smoogen wrote:
That sounds awfully low for Postnuke. Doing a quick google search of postnuke security fixes and just looking at different releases.. there should be about 20 with some amount in core and a lot in plugins. My information about the current state of PostNuke is not good. I am betting that they are doing a lot more for security but a number of 4 problems just was too low for the amount of systems I have had to 'clean' since 2002.
:( We haven't even installed it yet and the honeymoon is over? Just curious, what kind of problems did you have? Script kiddies or targeted attacks?
We have options with mod_security as well. I do want to make sure we have ourselves covered.
-Mike
That sounds awfully low for Postnuke. Doing a quick google search of postnuke security fixes and just looking at different releases..
there
should be about 20 with some amount in core and a lot in plugins. My information about the current state of PostNuke is not good. I am betting that they are doing a lot more for security but a number of 4 problems just was too low for the amount of systems I have had to 'clean' since 2002.
2002 was a _very_ long time ago in PostNuke development - though I accept there are some sites on the web that haven't been updated since then. I can safely say there is virtually 0 lines of code left from 2002. If you must include PostNuke, please do so only for the .760 version and above - all prior versions bear absolutely no resemblance to the current codebase at all, even .760 is only 25% like Zikula. Having been closely involved with the project for almost 7 years, I can say that the figures above are certainly accurate for 2008, and you won't see many more in 2007 either. All the security advisories I have seen were for legacy code which has been completely removed from Zikula now.
As I've said before, Zikula 1.0 has been reviewed both by automatic security tools (which gave Zikula a very favourable report compared to the competition) and by a security expert who has reported many security vulnerabilities in PHP CMSs over the years - and he didn't find any of the usual vulnerabilities like SQL injections. I'd also encourage anyone with a knowledge of PHP to take a look at the code. You'll see the culture of using the APIs is incredibly well spread to our extension developers, so that no one makes direct access to GET and POST, our database library automatically cleans variables before SQL queries and we have both input and output filters against XSS. Finally, we also have some advanced features like form tokens (to protect against CSRF), cookie signing, session regeneration etc that I haven't seen in (m)any other CMSs at all.
Seriously, I can accept that PostNuke in the dim and distant past had its issues, mainly due to its heritage, but I can't remember the last time I saw a vulnerability in any API compliant modules or the non-legacy parts of the core itself. Zikula has had 0 since its release almost 8 months ago.
:( We haven't even installed it yet and the honeymoon is over? Just curious, what kind of problems did you have? Script kiddies or targeted attacks?
We have options with mod_security as well. I do want to make sure we have ourselves covered.
infrastructure@lists.fedoraproject.org
-
Mike McGrath -
Simon Birtwistle -
Stephen John Smoogen -
Toshio Kuratomi