Brian Teeman

Whilst checking a site today I came across some code that triggered my scanner alert scripts.

I was unable to read the code as it was obfuscated/encrypted/encoded - select whichever you think is appropriate.

In the last weeks, I've taken a step back from my involvement into the Joomla project and took a good look at what we achieved. And let me say: Joomla has quite a lot of great and talented developers and basically all the work that has been done by them was good and deserves to be noted.

But I also saw, that we have huge problems. I'm not telling a secret when I'm saying that our releases are not really at a fast pace and we also didn't keep all our promises all the time...

But what is the cause of this?

jomsocial - a hackers dream with chmod 777

Spend any time on the joomla forums and you will see "help my web site has been hacked".

The first response is always the same "please read the security checklist"

In numerous places you will see

"Use proper permissions on files and directories. They should be should never be 777"

But with JomSocial the reverse is true!

The last upgrade for Joomla was the move from 1.0 to 1.5 over 3 years ago and yet we still see many, many Joomla sites running Joomla 1.0.

Why is it that - after people have bust their ass to produce a shiny new version of our product - users are so slow to upgrade?

What can be done to ensure that the same doesn't happen with the release of Joomla 1.6?

What can we do to ensure that we aren't supporting three different and incompatible releases of Joomla! on our client's web sites?

How can we ensure that all users will see the benefits of all the hard work?

We are used to communication being secure

If we phone with our mobiles, we assume that only the people we dialled can hear us.

When transferring money we provide information via the bank's web page and we trust that nobody else can use that information to withdraw money from our accounts.

Cyber Bullying - the dark side of the internet