User talk:Jehy

 Dear, Welcome to MediaWiki.org !

Yes, Welcome! This site is dedicated to the documentation of the MediaWiki software, the software behind many wikis, including that of Wikipedia and the Wikimedia Foundation projects.

Please, take a look at the following pages. They might prove useful to you as a newcomer here:
 * Project:About
 * How does MediaWiki work?
 * Help:Editing pages
 * Help:Navigation
 * Manual:FAQ

If you have any questions, please ask me on my talk page. Once again, welcome, and I hope you quickly feel comfortable here, and find this site a beneficial documentation of the MediaWiki software. Thanks, and regards,  Skiz zerz  20:31, 6 October 2008 (UTC)

safe_mode
For the thumbnailing thing, I removed that part since I didn't quite get what it was saying (you numbered them 1-4, but it seemed that some were steps for the same thing, and others were separate alternatives). If you wish to re-phrase that and wikify it better so that it could be more concise and clear, feel free to add it in.

For the image thumbnailing method that required changing php.ini, I'd leave that out since safe_mode should be set off if you have that sort of access. It does not close any security holes that common sense could prevent from happening in the first place by not running the script. That statement goes not only for MediaWiki (security holes are fixed pretty much as soon as they're discovered, and those are very few and far between), but for other software as well. By exercising common sense, it should be possible to disable safe_mode and still have a secure script and site.

Regarding the put_env, I took that out because it required hacking core files (which isn't recommended at all). Are these put_env errors just notices or actual errors. If it's the latter, feel free to add it back in, but if they're just notices (aka the wiki still works, just has a little notice on top), then perhaps an explanation of how to disable error reporting would be better.

As for the "things that may no longer work", I do not believe that it is possible to prevent deleted files from being saved any more, they just are.

Basically, to sum up the previous few paragraphs, I was being bold in trying to make it more presentable while removing opinionated statements. You can be bold as well in putting things that I removed back in, I won't revert you. I might discuss a specific change on the talk page to see if it could be better worded or something, though :) -- Skiz zerz  20:31, 6 October 2008 (UTC)

Safemode is neccesary
By exercising common sense, it should be possible to disable safe_mode and still have a secure script and site. No way) You see, I've been developing huge web projects for &gt;5 years already and I am very concerned about security issues. Do you really think that developers find ALL security holes and fix them QUICKER then hackers can use them? No way. I was at the role of the hacker too - if you need holes, you will find holes.

And now - just imagine that there are several huge projects on one server. There are many different CMS. You can't be sure that all users upgraded to the latest version of CMS. Also, you can't be sure that all of the latest versions are secure. The only way to separate these project somehow is to use safe mode - only it can act as an iron wall.

Right now, we're hosting more then hundred of different web sites - and I don't want any of them to become a hole which will suck everyone in. Also I can't be sure about even my wiki engine - when I looked through code I found it pretty f#cked up:)

PHP 6, without safe mode, is still in development stage and it will be more then year for it to become stable release. So no way we're going to disable safe mode. --Jehy 20:50, 6 October 2008 (UTC)
 * You, sir, are very paranoid. Safe_mode is probably one of the worst ways to prevent hackers. The easiest way is to know what you are installing and running and keep up-to-date with security updates. Restricting access to certain features helps as well. Also, I have an account on a shared webhost where there are many people that don't necessarily have the most up-to-date stuff. However, that site has safe_mode off, yet they don't seem to have any sort of security issues. In other words, even if someone can hack through one user's space on a site, that does not mean the entire site is compromised (trust me, I've tried various methods in order to gain shell access, none of them worked. Having a sane list of disabled functions and perhaps installing the Suhoshin PHP extension/patch should keep your site very safe while still keeping safe_mode off). And you say the code is fucked up? Yeah, I'll have to agree with you there. However, it is very secure. Just go ahead and try to find a security hole in a default installation of the latest MediaWiki trunk and/or stable release (without messing with any of the default settings or installing any extensions). If you manage to find one, please let me know that you did (don't tell me what it is -- e-mail security@wikimedia.org regarding that), and maybe then I'll rethink my position. -- Skiz zerz  20:47, 7 October 2008 (UTC)

put_env
then perhaps an explanation of how to disable error reporting would be better. Oh, yeah, good note, thanks, somehow forgot about that:). --Jehy 20:53, 6 October 2008 (UTC)