946 reputation
1334
bio website artlung.com
location San Diego, CA
age 44
visits member for 3 years, 8 months
seen Mar 18 at 5:19

I am a web developer and some-time designer, blogger. Tech interests: PHP, MySQL, JavaScript, especially OO, jQuery, Flash, Open Source libraries of all kinds, WordPress, SilverStripe, Drupal, and more. I like to make web things.

You can reach me at joe@artlung.com

On twitter @artlung

See also: joecrawford.com


Jun
18
awarded  Popular Question
Jun
14
awarded  Good Question
Mar
17
awarded  Benefactor
Mar
16
comment Getting rid of files not used by latest upgrade
Can you list some filenames of such files?
Mar
16
accepted Local copy of WordPress Codex?
Mar
16
comment Local copy of WordPress Codex?
This is a great lightweight way to quickly save a large group of files. I was hoping for self-contained, but I've been testing this since I opened the bounty and this is the easiest quickest way to get a local copy of the relevant docs.
Mar
14
comment Local copy of WordPress Codex?
@EAMann actually I know a few folks using IIS but I take your point. I will say again that the instructions linked to lack detail. There's no "recipe" created to actually run the backup.
Mar
13
comment Local copy of WordPress Codex?
This is pretty great. Is there a way to feed it a list of urls to capture for later viewing? And is there a way to say "go refresh this list of urls"?
Mar
10
awarded  Nice Question
Mar
10
awarded  Announcer
Mar
10
comment Local copy of WordPress Codex?
Is it possible to store into a static set of html, or do I need to be running Apache/PHP (or whatever current MediaWiki requirements are) on the target device? The Implementation details lack a simple set of instructions, they instead point to other solutions in various stages of completeness. sciencemedianetwork.org/wiki/…
Mar
9
comment Side effects of disallowing *.php requests in production environment?
wp-admin is indeed removed. database is indeed firewalled. whole site has a load balancing infrastructure in front of it with intrusion detection included.
Mar
9
accepted Mechanism to send to users of secured WordPress install new notifications by SMS or email?
Mar
9
accepted Side effects of disallowing *.php requests in production environment?
Mar
9
comment Side effects of disallowing *.php requests in production environment?
Yes, I've looked at some of the plugins we're using and we appear not to be using anything that has a "public-facing" .php file. I'll have to look at all of them a bit closer. Thanks for the coherent answer!
Mar
9
comment Side effects of disallowing *.php requests in production environment?
"If you code correctly, simply calling a PHP file is not enough to hack your site" yes, but WordPress and plugins are third party code. Saving to static files is not a bad idea, but for a site with a great deal of content, this has a different downside, that of a much larger file to be replicated. I appreciate the thought though. Ultimately most people are finding the premise of my question bizarre. :-( Hah! So bizarre someone felt the need to downvote. How helpful!
Mar
9
comment Side effects of disallowing *.php requests in production environment?
@Wyck, I assure you we have operations people who understand security. They deal with tens of thousands of concurrent connected users and devices continuously in other parts of our business. This is the real deal. What I'm trying to understand it myself, thus the question. :-)
Mar
9
comment Side effects of disallowing *.php requests in production environment?
@Steven, yes, AJAX calls to wp-admin/admin-ajax.php would not be possible given this configuration. This ie mentioned at: codex.wordpress.org/Hardening_WordPress#Securing_wp-admin
Mar
9
comment Side effects of disallowing *.php requests in production environment?
Grabbing the feed from another WordPress site leaves 2 open and potentially insecure instances of WordPress on the internet. That's not an answer. And no, posting and comments do not work on this published WordPress instance. This is a feature not a bug, and questioning this aspect of the question means you are not understanding the basis of my question so can't help me. I appreciate you chiming in, but it's not helpful.
Mar
9
comment Side effects of disallowing *.php requests in production environment?
Let's say plugin "Foo" has a vulnerability -- preventing direct calls to say wp-content/plugins/foo/Foo.php would allow the plugin to run only when called from inside other content, but would disallow direct calls to the file. The reason I'm asking about .php file disallow is because I don't really have a good answer for how or why it works either. But my "Foo" example is the best of my knowledge.