Re: PHP7

Hi Ian,

Thanks for the quick reply. It's nice to know there's someone out there 
on the other end of this list.

The services Maia provides are exactly what I'm looking for.  It's 
surprising to me more admins have not found it useful enough to 
implement, as well as contribute to its development.

I agree with your assessment of PHP security. I've seen presentations on 
SQL injection through PHP variables (PhreakNIC.info), and the importance 
of being careful cannot be overstated.

I run phpMyAdmin on my server. I realize security-by-obscurity is not 
ideal, but I've implemented 3/4 of the security suggestions at this 
link:
https://www.tecmint.com/secure-phpmyadmin-centos-ubuntu/

Mine is a small server, and I'm the only one with administrative access 
to it, so my exposure is not too bad.  I use Roundcube, and Nextcloud, 
both of which are PHP applications with access to MySQL. Both are in 
current development, with quick response to vulnerabilities as they are 
discovered.

Implementing a tool like Maia, to which my other users would have access 
similar to Roundcube and Nextcloud would worry me, knowing Maia is not 
in current development.

That's the biggest reason I'm reluctant to run PHP5 concurrently with 
PHP7. Many of the upgrades, as I understand it, were security related. 
Retiring the "MySQL_" functions, for example, seems intended to force 
programmers into a more secure way of coding.

I don't pretend to be an expert. I hand-code two fairly large websites 
for family businesses, both in PHP, but I have (so far) managed to steer 
clear of the need for database interface, preferring to use some flat 
text files for data.

I understand enough about most of the issues that I might at least be of 
help writing documentation.

I admit I'm having trouble figuring out the relationship between 
spamassassin and amavis, and how to make amavis deliver spam to a Junk 
folder, instead of simply discarding it, which is what my mail server is 
currently doing.  This is what prompted my initial interest in Maia.

Nevertheless I'm willing to help.  If you ever decide to upgrade Maia to 
work with more modern platforms (PHP7), I will gladly offer some of my 
time to help with documentation.  When I can grasp complex issues 
myself, I'm pretty good at writing them out in ways that help others 
with less knowledge than myself to "get it".




On 2017-11-29 3:55 am, Ian R. Justman wrote:
> Here's a link to get PHP 5.6.x onto a Xenial system:
> 
> https://by-example.org/ubuntu-16-04-xenial-downgrade-php-7-to-php-5-6/
> 
> In fact, you can still have Ubuntu's native 7.0/7.1 and this 5.6
> distribution all installed and working alongside each other.
> 
> And as far as I know, the PHP side of the house has yet to be updated
> to support PHP7.  Given what little I know of PHP in general (and how
> much the whole notion of PHP scares me when it comes to security*1,
> I'm scared to death of even thinking of trying.
> 
> As for Ubuntu, being an Ubuntu type myself, I did my thing to get
> things working.  Past releases of Ubuntu worked best if I also
> installed pkgsrc, but the need is now gone.  I think I'm going to have
> to redo my documentation at some point to make sure it can be reliably
> reproduced. With 18.04 just down the pike, I should start working on
> that soonish (even with just Arty Aardvark out now).
> 
> --Ian.
> ---------------
> * See WordPress and phpMyAdmin as classic examples of PHP apps with
> poor security track records.
> 
> ---
> Ian R. Justman
> UNIX hacker.  Anime fan.  Any questions?
> ianj (at) ian-justman.com
> Please direct business correspondence to my new address, biz (at)
> ian-justman.com. (04/27/2015)
_______________________________________________
Maia-users mailing list
[email protected]
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users