3

My blog is painfully slow for the last few days, and I would like to pay someone (anyone?) 15 BitCoins to optimize it for me (I would do it myself, but I'm not sure I have the time right now).

It's currently hosted at GoDaddy. What I'm thinking is giving him a snapshot of the filestructure of my blog, and asking him to setup an Amazon EC2 image that will run it.

After I test his image, I will switch my domain to point to the new EC2 instance and change the admin password. My blog is rather small (only 80 readers), and I gather I don't have anything vital/precious/secret there. The private information I could think of that I wouldn't want leaked is perhaps a few emails addresses from some of my users (not that happy about it being leaked, but I assume that email addresses aren't that expensive, and nobody will have the incentive to do anything interesting with them).

Do you think it's a viable option? Or instead, should I absolutely not do, in order to protect my user' privacy? What are security risks are there?

BTW, I don't yet have anyone specific in mind. If you're interested, ping me at [email protected].

Edit - cross link to the post on bitcoin.org forums.

Improve this question
6
  • You should simply change all passwords you give him or just add users w pass (blog, host & db) that you can delete afterwards.
    – kaiser
    Mar 29, 2011 at 12:51
  • @kaiser take a look at my answer
    – Ashfame
    Mar 29, 2011 at 13:36
  • @Ashfame: Sorry, but i don't really get it. What are you trying to tell me? To make this clear: I'm not the one who asked the Q.
    – kaiser
    Mar 29, 2011 at 13:43
  • @kaiser I wanted to mention that its possible to put in a small snippet somewhere which will change the admin password to something after certain amount of time. So everything might look okay even after changing all the passwords but technically the password will be changed to what I already know after a certain time. :)
    – Ashfame
    Mar 29, 2011 at 14:02
  • 1
    Honestly, I think you're overthinking this. Find someone with a reasonable reputation and you'll probably be ok. There's always a security risk in giving access to someone else, but in this case I don't think it's worth worrying about too much.
    – anu
    Mar 31, 2011 at 8:01

2 Answers 2

Reset to default
3

Yes, there is a risk! I can put up a check on date to change your password, create a new user and what not. Don't give access to someone you don't trust. Hire a professional to do the job.

Edit: Okay! Upon request, I have explained two cases in a blog post - http://blog.ashfame.com/?p=903

Improve this answer
9
  • 1
    Sounds smart. I'd def. +1 your A if you offer a code snippet :)
    – kaiser
    Mar 29, 2011 at 14:24
  • Sure! I will be doing a WP Evil series on my blog. Will post the code here, once I have the post ready.
    – Ashfame
    Mar 30, 2011 at 13:39
  • @kaiser @ripper234 I have added the link to code snippets. Take a look!
    – Ashfame
    Mar 31, 2011 at 6:05
  • How does this help? You've added a plugin / function to create a new admin password, but your new admin password is stored in cleartext in the code. So, anyone with access to the filesystem will be able to see the new password. This is probably more dangerous than doing nothing as it encourages a false sense of safety.
    – anu
    Mar 31, 2011 at 7:59
  • @anu The purpose is to demonstrate how someone can plant a backdoor to be created after a certain point of time, if you happen to give access to someone. You can hide it anywhere, its not about securing, its about breaching. Does everyone check every line of code? Even developer don't, what to say about users. Moreover its not a public release that it will get caught easily but its for the specific question here that "there is risk". This is just a basic approach, you can do a lot more. I hope I made my point clear.
    – Ashfame
    Mar 31, 2011 at 8:37
2

Anyone in the IT business is exposed to private information all the time, so there has to be some trust there. The e-mail addresses of your users certainly isn't a big secret. It's not like he is going to spam them and certainly there's no money in selling a list of 80 users :)

Still, you need some level of trust with the person you get to help you, there is more damage they could do besides stealing e-mail addresses. For example they could just install a trojan or backdoor to your blog. Yeah that is a bit paranoid but it is nonetheless a risk.

You should be careful to get someone who you can get some reputation info on. Or you could go to odesk.com or elance.com where a good feedback system is in place.

On a separate note, I wouldn't set up on EC2 if you don't know how to manage and maintain linux. It is too hard keeping up with all the security issues if that isn't your area of expertise. You may want to try something like WPWebHost. We use rackspace cloud sites. It's $150/month but very fast and very reliable.

Improve this answer
2
  • It's not worth $150 a month for me at the moment, but thanks for the tip and the answer.
    – ripper234
    Mar 29, 2011 at 14:28
  • Just get a VPS with Linode or Slicehost or Bytemark - probably cheaper than EC2 and you don't have to worry about non-persistent storage in case of failure
    – anu
    Mar 31, 2011 at 8:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.