991 reputation
11435
bio website artlung.com
location San Diego, CA
age 44
visits member for 4 years, 1 month
seen Sep 9 at 19:16

I am a web developer and some-time designer, blogger. Tech interests: PHP, MySQL, JavaScript, especially OO, jQuery, Flash, Open Source libraries of all kinds, WordPress, SilverStripe, Drupal, and more. I like to make web things.

You can reach me at joe@artlung.com

On twitter @artlung

See also: joecrawford.com


Mar
9
comment Side effects of disallowing *.php requests in production environment?
@Wyck, I assure you we have operations people who understand security. They deal with tens of thousands of concurrent connected users and devices continuously in other parts of our business. This is the real deal. What I'm trying to understand it myself, thus the question. :-)
Mar
9
comment Side effects of disallowing *.php requests in production environment?
@Steven, yes, AJAX calls to wp-admin/admin-ajax.php would not be possible given this configuration. This ie mentioned at: codex.wordpress.org/Hardening_WordPress#Securing_wp-admin
Mar
9
comment Side effects of disallowing *.php requests in production environment?
Grabbing the feed from another WordPress site leaves 2 open and potentially insecure instances of WordPress on the internet. That's not an answer. And no, posting and comments do not work on this published WordPress instance. This is a feature not a bug, and questioning this aspect of the question means you are not understanding the basis of my question so can't help me. I appreciate you chiming in, but it's not helpful.
Mar
9
comment Side effects of disallowing *.php requests in production environment?
Let's say plugin "Foo" has a vulnerability -- preventing direct calls to say wp-content/plugins/foo/Foo.php would allow the plugin to run only when called from inside other content, but would disallow direct calls to the file. The reason I'm asking about .php file disallow is because I don't really have a good answer for how or why it works either. But my "Foo" example is the best of my knowledge.
Mar
9
comment Side effects of disallowing *.php requests in production environment?
To address the issue of why you might secure or remove wp-admin/ see: codex.wordpress.org/Hardening_WordPress#Securing_wp-admin
Mar
9
asked Side effects of disallowing *.php requests in production environment?
Jan
26
awarded  Popular Question
Sep
14
awarded  Nice Question
Aug
12
awarded  Yearling
Jun
18
comment Mechanism to send to users of secured WordPress install new notifications by SMS or email?
That sounds pretty good. I was hoping there was a solution, but the pieces seem straightforward enough that I can make a go of building this for myself. I probably will end up, rather than using "official" SMS, just using the "email" equivalents for cell numbers like networking.ringofsaturn.com/Telecommunications/… - not as nice as SMS, but simpler from my perspective. If I were commercializing it, it would be great to allow them to turn on and off alerts via SMS.
Jun
18
asked Mechanism to send to users of secured WordPress install new notifications by SMS or email?
Jun
14
awarded  Citizen Patrol
Mar
15
answered New Admin Bar Not Functioning
Feb
8
accepted Is there a theme function for is_password_protected()?
Feb
8
comment Is there a theme function for is_password_protected()?
Doh! How'd I miss that? Thanks for speedy answer!
Feb
8
asked Is there a theme function for is_password_protected()?
Feb
2
comment In multisite environment which is the most Popular blog?
Curious to hear if you have made progress on a "most comments" plugin for Multisite.
Dec
11
awarded  Quorum
Dec
9
awarded  Precognitive
Oct
29
awarded  Nice Question