Joomla! Discussion Forums

Sorry for the broad spectrum of this thread, but in an article posted here:

http://tinyurl.com/z9d5w

It discusses security flaws of web 2.0 applications.  So do we all need to be
concerned?  Can anyone suggest steps to take?

Joomla itself is very good at security. the recent spate of hacks have all been aimed at 3rd party extentions that are weak.

I do not know for sure but I do remember reading that AJAX was not something the Devs were actually looking at using for much in J!

So I don't expect to see much of it in any future releases of J!

From other topics, it has been discussed that Joomla! rolls out security updates very quickly after "holes" are discovered. One of the team members noted that Joomla! reports most of the "holes" in the system. Most of the sites that are hacked are running outdated versions of Joomla!, outdated versions of extensions, or extensions that are unsecure.

I think the article you're pointing to is mainly saying before you rush off to use a new piece of technology (in this case AJAX) as a programmer, you need to remember the basics (such as security). It's not saying that it's impossible to make AJAX applications secure, just that people tend to forget about it.

With AJAX, I think it's easy for programmers to forget that anyone can craft an HTTPRequest that looks like it's coming from an AJAX application without actually coming from that AJAX application. It's another attack vector to be aware of.

david