Re: redoing website after 7 years
| From: | Jim Lucas | Date: | Thu, 08 Jan 2009 00:16:15 +0000 |
| Subject: | Re: redoing website after 7 years | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-285626@lists.php.net to get a copy of this message | ||
Nathan Rixham wrote:
Richard Heyes wrote:If one was to go this route, then why not just use a .htaccess file and turn on register_globals and call it good? I mean really, the customer would be in no greater risk then what they had been for the last 7 years. Reason being, nothing else has changed about the script. If their is an exploit in the script now, then their was an exploit in the past. I realize that I am going against what I preach here. But really, the ISP isn't going to pay for it. The own isn't going to want to pay for it. Can't squeeze blood from a turnip... If the programmer designed an insecure web site 7 years ago then the programmer should be responsible for making the application secure. That was part of his/her job in the beginning. I mean, sure when I first started designing/building web sites I thought I was doing the right thing most of the time. If two years down the road I had a moment of clarity and I realized that I had been doing something wrong or in-secure for the past two years (which I've done) then I would go back and tell the customer that I did something wrong or in-secure and I would fix it for free. Thia is part of my responsibility as a designer With that said, I would image that over the past 7 years, if the site has not been exploited, then I would think that by turning register_globals back on would be of no concern. To me, all the above sounds logical. If I am missing something, please point it out. -- Jim Lucas "Some men are born to greatness, some achieve greatness, and some have greatness thrust upon them." Twelfth Night, Act II, Scene V by William Shakespeareconcurred, personally I'd be tempted to offer to find or indeed resetup on an old server if they could find one for free, but as for upgrading certainly quote/charge.but, I'm more concern does client has to pay the changes/upgrade or it's still "my obligation"?Of course you charge him. Christ if I was expected to maintain stuff gratis that I wrote 7 years ago I'd be mullahed.