Neal Poole

That configuration contains a major security vulnerability, at least if your site allows file uploads (I tested it on my server to be sure). I've written about this issue before: https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-do… Edit: You need to copy the try_files line into the PHP location block. I'd recommend using the following line (I just added =403 to the end of yours, so you return a 403 error rather than a 500 error when try_files fails): try_files $uri $uri/ /index.php?$query_string =403;

Also in 2010 there was a file storage system based on Bitly: https://nealpoole.com/blog/2010/12/bit-ly-file-storage-cleverness-and-… Super clever idea, except for the part where Bitly now sprinkles links with affiliate codes to make $$$

From 2010: https://nealpoole.com/blog/2010/12/bit-ly-file-storage-cleverness-and-…

Read through https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-do…

Definitely. Paying such a small amount, especially in credit that can only be redeemed in a company store, is patronizing and gets you mentioned in a negative light on Hacker News. If you don't pay, you're just like one of the many companies that doesn't have a bounty program. Edit: this reminds me of the "eBay goodies" offered to researcher Neal Poole in return for delaying disclosure of a vulnerability [https://nealpoole.com/blog/2013/03/bad-changes-to-ebays-responsible-di… I would probably not have remembered that story if not for that "eBay goodies" line, just as I probably won't forget this story thanks to the screenshot of Yahoo-branded socks in the company store.

Also check for this dangerous configuration bug if you are using FastCGI and PHP (I'm not sure if this also applies to other FastCGI applications) https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-do…

Some blogs I like (most are not updated very frequently, though): Billy Rios (discovered GIFAR) http://xs-sniper.com/blog/ Michal Zalewski (one of the top security researchers in the world, wrote "The Tangled Web", a must-read) http://lcamtuf.blogspot.com Neal Poole: https://nealpoole.com/blog/ Nir Goldshlager: http://www.nirgoldshlager.com/ Michael Brooks: https://sitewatch.me/en/Blog Nils Jünemann: http://www.nilsjuenemann.de/ Stefano di Paola (Minded Security): http://blog.mindedsecurity.com/ Root Labs: http://rdist.root.org/

Yikes. Any site with a publicly accessible swfupload.swf is open to XSS. https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupl…

I was actually wondering not long ago if there might be some kind of cross-site scripting vulnerability implicit in rendering exceptions as html. Sure, you shouldn't have error reporting on to begin with but who even checks the source code of the exception pages themselves? You're paying close attention to the error itself after all... Turns out yes maybe... https://nealpoole.com/blog/2011/08/cross-site-scripting-via-error-repo…

There was a bit of chatter recently about ill-configured nginx-fastcgi servers having a php vulnerability. Seems to be summed up here: https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-do… Thanks for the keep-alive tip. I missed that one. EDIT: I see that the author of the post I linked replied below- also with the link.

>And it turns out to work incredibly well for the most part. It's serverless by design! Worked incredibly well compared to what? CGI was a performance nightmare, forking per request. CGI and FastCGI have both been a security nightmare. HTTPoxy, Shellshock, Pathinfo, and more. Setting up PHP correctly is cumbersome and depends on a complex interaction between sometimes confusing php.ini options and fairly complex configurations with your webserver. Check out, for example, this article on configuring PHP properly with Nginx: https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-do… So other than that, yes, it worked. Incredibly well? Not compared to application servers which don't have the kinds of vulnerabilities and configuration complexities caused by the weird impedance mismatch between webservers and FastCGI workers. The jab about serverless is really condescending and unrelated, but I feel it necessary to point out that I am not really especially a proponent of serverless as it is today. I much prefer long-running application servers. PHP-FPM gives you a bit of both worlds, a combination of them that is far from ideal in my opinion. >Again, I don't see how this is a problem. Routing is likely to be the most trivial part of your app, but it's also tied to business logic and should (IMO) be part of the checked-in code. I am having difficulty responding to this because I think you misunderstood what I meant.…