Re: [nyphp-talk] [OT] XSS, Joomla & Remote Shells

2007-06-28 Thread Jon Baer
Just for reference: http://wordpress.org/development/2007/03/upgrade-212/ BTW, you said it nicely, the point being that many smaller shops don't have time for monitoring items that Snort or Tripwire pick up (Network Security Monitoring). Neither do I but staying on top of the packages you

Re: [nyphp-talk] [OT] XSS, Joomla & Remote Shells

2007-06-28 Thread Ben Sgro \(ProjectSkyline\)
Hello Jon, Great points. I think an even worse attack would be what happened to WordPress not too long ago, the code itself on the distribution servers was tinkered with. Wow, that's really awful. Didn't know about that. It's a little unfair to point out XSS as being only a Joomla issue.

Re: [nyphp-talk] [OT] XSS, Joomla & Remote Shells

2007-06-28 Thread Jon Baer
I think an even worse attack would be what happened to WordPress not too long ago, the code itself on the distribution servers was tinkered with. It's a little unfair to point out XSS as being only a Joomla issue. It happens to any software that lingers past even a single minor 0.1 upgrad

Re: [nyphp-talk] When to close a mysql connection

2007-06-28 Thread David Krings
Ben Sgro (ProjectSkyline) wrote: Hello, Doesn't using pconnect take care of this? http://us.php.net/manual/en/function.mysql-pconnect.php What's the best implementation?(provide some source if you can...) - Ben I currently have the connection stuff inside of an include file. So I basically

Re: [nyphp-talk] When to close a mysql connection

2007-06-28 Thread Ben Sgro \(ProjectSkyline\)
Hello, Doesn't using pconnect take care of this? http://us.php.net/manual/en/function.mysql-pconnect.php What's the best implementation?(provide some source if you can...) - Ben Ben Sgro, Chief Engineer ProjectSkyLine - Defining New Horizons - Original Message - From: "Jakob Buchgrab

Re: [nyphp-talk] When to close a mysql connection

2007-06-28 Thread Jakob Buchgraber
David Krings wrote: Hi! Up until now I always opened a db connection to MySQL, did my query stuff and then closed the connection again, went on to the next script, opened the db connection, did some more queries, closed the connection, went to next script. Is there anything speaking aga

[nyphp-talk] When to close a mysql connection

2007-06-28 Thread David Krings
Hi! Up until now I always opened a db connection to MySQL, did my query stuff and then closed the connection again, went on to the next script, opened the db connection, did some more queries, closed the connection, went to next script. Is there anything speaking against making the db li

[nyphp-talk] [OT] XSS, Joomla & Remote Shells

2007-06-28 Thread Ben Sgro \(ProjectSkyline\)
Hello again, I've always had an interest in security. Not too long ago a friend was looking into deploying joomla for a client. He's a pentester/researcher for a very well educated and influential firm = ] , so he had to make sure it was going to be secure. He started researching and found tha

[nyphp-talk] Rely on destructor to be called?!

2007-06-28 Thread Jakob Buchgraber
Hey! I am writing a logging class which writes all the data that are to be logged in a buffer and when the destructor is called the buffer is cleared and written to some data storage. So I wanted to know whether I can rely on the destructor to be called. In my tests I just figured out that i

Re: [nyphp-talk] DB Schema for storing revision history?

2007-06-28 Thread csnyder
On 6/27/07, David Krings <[EMAIL PROTECTED]> wrote: Steve Francia wrote: > The version table would have the document_id, content and the mod_date > and author_id. I am by no means a database expert, but why would one want to store guaranteed to be static data in a table such as the content. That

Re: [nyphp-talk] Questions to ask at a job interview?

2007-06-28 Thread CED
Beautiful point Steve. Critical thinking is certainly a talent that is taken for granted, and often missed in the standard interviewing process. Although workspace cleanliness and code hygeine is 'nice-to-have' I'd trade it for the guy that I could drop an emergency project on, and is going to res

[nyphp-talk] Questions to ask at a job interview?

2007-06-28 Thread Kurt Zimmerman
This is a rather interesting topic and I am quite amused with some of the answers. To start, I have over 27 years in IT. I've been through the ranks of programmer in all sorts of languages. Some of my greatest achievements were to take a medium size corporate lending company into the modern age

RE: [nyphp-talk] Questions to ask at a job interview?

2007-06-28 Thread Mark Armendariz
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ben Sgro (ProjectSkyline) > So, again, what are some good metrics I can use to test these perspective employees? Some great articles on hiring developers... FizzBuzz - having the programmer solve a simple programming problem (by Re

Re: [nyphp-talk] Questions to ask at a job interview?

2007-06-28 Thread David Krings
Generally speaking, I imagine it greatly diminishes the effectiveness of your interview to be offended by standard interview techniques and to respond with hostility. Then again, I've had my job for 7 years now; maybe I forgot what interviewing is like. -c Agreed and stand corrected on th

Re: [nyphp-talk] Questions to ask at a job interview?

2007-06-28 Thread Christopher R. Merlo
On 6/28/07, David Krings <[EMAIL PROTECTED]> wrote: While that [cleaning legacy code -CRM] is indeed a good exercise it may backfire and make your development team look chaotic and disorganized. It may also give the impression as if it is OK to create ugly code. You or someone on your team appar

Re: [nyphp-talk] Questions to ask at a job interview?

2007-06-28 Thread Ben Sgro \(ProjectSkyline\)
Hello, Lots of good points. In that case you may also consider someone who does PHP development as a hobby (like me), but has many other skills such as software QA and support experience (like me)uh, did I just apply for the job? ;) You can always teach them about objects and classes later

Re: [nyphp-talk] Questions to ask at a job interview?

2007-06-28 Thread Steve Manes
Ben Sgro (ProjectSkyline) wrote: Now, the position being filled is that of an entry level programmer. I do not expect this person to be well trained in PHP/MySQL, but they must have a pretty strong understanding of programming methodologies in general (they are a college grad - CIS). So, again,

Re: [nyphp-talk] Questions to ask at a job interview?

2007-06-28 Thread David Krings
Hi! I never hired or interviewed anyone, but currently look for a new job and can tell you some of the questions that I ask and my point of view of things you consider doing during the interview. Ben Sgro (ProjectSkyline) wrote: Hello all, /So, once again, depending on the actual job desc

Re: [nyphp-talk] Questions to ask at a job interview?

2007-06-28 Thread Ben Sgro \(ProjectSkyline\)
Hello all, So, once again, depending on the actual job description, I might take some ugly code (in any real work environment, there should be no shortage of that :), print it out, and give the candidate a pad and a pen, or a text editor, and say "Clean this up. I'll be back in 20 minutes."

Re: [nyphp-talk] Questions to ask at a job interview?

2007-06-28 Thread Christopher R. Merlo
On 6/28/07, Ben Sgro (ProjectSkyline) <[EMAIL PROTECTED]> wrote: Good Morning, In a few days, I will be sitting down with a perspective employee, and I'd like to get some feedback on good programming questions or excercises I can have them work on. I think this mostly depends on what you wa

Re: [nyphp-talk] Questions to ask at a job interview?

2007-06-28 Thread Kenneth Downs
I can only offer my experience, which I hope will help some. The best employees I've ever had for difficult or changing situations were those with general problem-solving skills. In my two best cases, neither knew anything about the programming language we were using or the database when they

[nyphp-talk] Questions to ask at a job interview?

2007-06-28 Thread Ben Sgro \(ProjectSkyline\)
Good Morning, In a few days, I will be sitting down with a perspective employee, and I'd like to get some feedback on good programming questions or excercises I can have them work on. At my last job, prior to becomming a fulltime consultant, I was asked to create a login function, that checked