Disqus - Latest Comments for sminnee

Re: Ben Nolan - Mini rave for kiwiburn

sminnee — Sun, 24 Nov 2013 23:08:41 -0000

I've seen people do this kind of thing in wheelie-bins, which means you can cart it out. Even if it was smaller than that, putting it all in a wheeled box could work quite well.

Re: Ben Nolan - Script defer

sminnee — Mon, 02 Sep 2013 22:54:50 -0000

You might also want to get rid of your inline script blocks? :-P

Re: Ben Nolan - Script defer

sminnee — Mon, 02 Sep 2013 22:28:47 -0000

Is this better than $(document).ready( function() { new GoogleMapsInstance(some params); });

Re: Silverstripe 3 DOS vulnerable

sminnee — Wed, 17 Jul 2013 22:24:47 -0000

Hi Chris,

Thanks again for raising this issue with us and digging in more detail into its effects.

I can see that it would be concerning to find that a DoS issue you had raised had already been logged in our bug tracker and not yet resolved. Ultimately, when the issue came to our attention we had rated it as not a severe issue, and so we prioritised it alongside other issues for resolution. This impacted the urgency with which we addressed it. There were a few reasons for that. Firstly, a server configured with a lower MaxClients won't be as susceptible to a full DoS of the server from this bug - the server would be up although responses would slow down, and the offending IP address could be blocked. It's not ideal, but it would be manageable in the case of an attack via this (which, to our knowledge, has never happened). Also, there is no information disclosure or control an attacker would get from flushing a site: the flush is intended to be able to be called at any time without affecting the functioning of the site. That, combined with the fact that the fix wasn't trivial to make, led to the issue being still open at the time you started your investigation.

As for how the issue got into the system in the first place: when it was originally developed, the scope of the flush command was much more limited and the performance impact was not great enough to be a DoS target. It was a toss-up as to whether we would execute the functionality automatically by detecting the necessary changes, and in the end decided to make it manually triggered. That changed over time as the script behind it got more weighty, and now we need to solve it.

But that's all in the past. What's important now is that we fix the issue and put it out there for people who may be affected. The fix is almost complete and we will release security updates for 2.4 and 3.0, as well as including the fix in 3.1-rc1 (imminently awaiting release) and providing patches for people to apply the fix themselves. In the meantime, Hamish has put together some workarounds that you can apply here: https://github.com/silverst...

It's not for me to comment on the details of DIA's security testing of CWP, apart from saying that there has been a robust, independent process underway in the lead-up to its launch.

Thanks,

Sam Minnée
CEO
SilverStripe Limited

Re: Why I Stopped Telling Young Girls to Go Into Engineering

sminnee — Mon, 19 Mar 2012 00:25:57 -0000

It sounds like you need a holiday. A proper one.

Re: Web Based Application Development in Australia by Working Software specialising in Hosted Content Management Systems on Demand (SaaS CMS) and Web Based SMS gateway services

sminnee — Sun, 11 Dec 2011 03:31:43 -0000

Build an app using this approach and then I'll listen. ;-)

Re: Ben Nolan - Twitterplaces

sminnee — Thu, 28 Oct 2010 00:24:50 -0000

Boobs.

Re: installation-on-webserver | Documentation Wiki

sminnee — Sun, 29 Jun 2008 18:04:19 -0000

I have put this ticket up suggesting some improvements to the rewritetest.php system: http://open.silverstripe.co...

Lukin - it would be helpful if you could add yourself to the CC field for the ticket, so that you can see if new versions of this feature work on your configuration.

Re: installation-on-webserver | Documentation Wiki

sminnee — Sun, 29 Jun 2008 18:02:45 -0000

Hi Jess,

If you can set up a database login with CREATE DATABASE rights, then the installer will create the database for you.

Re: tutorial:site-map | Documentation Wiki

sminnee — Tue, 24 Jun 2008 22:32:32 -0000

We're deliberately trying to stay away from using widgets as a main composition tool, as it winds up creating an additional layer that content authors have to wade through in order to get their job done. For this reason, widgets are restricted to subordinate content on pages, rather than main content.

Furthermore, there's very little overhead in creating a new page type - it's almost exactly the same as the overhead needed to make a widget. :-P

That said, a site-map widget could be useful. It might also be worth exploring whether using something like widgets to *optionally* add additional content to pages, particularly if the widgets available were specifically designed to work nicely when used in the main content.

A related issue here is the use of page types for making simple layout changes - for example, swapping between one column of content and columns of content. Perhaps layout and page type could be 2 separate things?

If we were to head down this path, we would be pushing the CMS classes to be more focused on the data being stored. The key challenge would be to ensure that site management was still logical for people who just wanted to add or edit a few pages. This is an area where other CMSes have gotten into trouble.

Re: sitemap | Documentation Wiki

sminnee — Tue, 03 Jun 2008 16:26:55 -0000

The sitemap.xml request is handled dynamically, by the GoogleSitemap controller. Look for GoogleSitemap.php

Re: tutorial:1-building-a-basic-site | Documentation Wiki

sminnee — Sat, 24 May 2008 21:51:09 -0000

We should really update this tutorial to make use of blackcandy, and focus the tutorial steps on altering the initial layout, rather than making a layout from scratch.

Re: tutorial:site-map | Documentation Wiki

sminnee — Wed, 21 May 2008 17:09:01 -0000

One of the problems currently is that our views don't support recursion. Hence, the use of getChildrenAsUL. Hence, the mixing together of View and Controller (and even Model, sadly) logic.

Re: genericdataadmin | Documentation Wiki

sminnee — Tue, 13 May 2008 15:52:09 -0000

Form scaffolding and the many-many auto-complete CTF-style field will be coming in version 2.3. You can expect them in trunk some time in June.

Re: statistics | Documentation Wiki

sminnee — Tue, 13 May 2008 15:50:22 -0000

In either version 2.2.3 or 2.3, statistics is going to be moved into its own separate module.

Re: Documentation Wiki

sminnee — Sun, 11 May 2008 23:11:05 -0000

http://doc.silverstripe.com and http://api.silverstripe.com now have a commenting system, powered by Disqus!