Forum

Dear Hugo,

I notice a increase of people who likes to run Joomla on a Apache Server. I have read some reaction of your opinion about the architecture of Joomla.

I had to laugh because you said that that system has been grown "ugly" big. But serious.

I have spend days (and ik think not only me) to get Joomla running on Hiawatha. I admit that is because of my lack on technical skills.

Despite i Have managed to het the Hiawatha Server Running. This after typing the url http:/localhost/. After that I have attempted many times to modify some ini files like Hiwataha, php, etc....

To be honest I got lost in the files and scripts. Is this not for you a Great opportunity to join forces with Joomla.

Because I really like your focus on the security aspect of your webserver in combination with your Banshee framework approach.

I have already left a post on the Joomla Forum. I asked them for a installation package for Hiawatha servers as they have for Apache.

Based on their reaction they do not have it.

Can you help me out this "ugly" problem?

Regards,
Lucien


Hiawatha version: 8.5
Operating System: Windows 7

You had to laugh because you agree with me or you don't? If you don't agree with me, I'll tell you this: my server or any other Banshee based website has never been hacked. Compare that to this [secunia.com] and laugh again...

You spent days to get Joomla running on Hiawatha? No offense, but this is 100% because of your lack of skills. I've received lots of e-mails from people thanking me for Hiawatha being so easy to setup. I'm sure that if you would have read the howto pages, you would have been done in 5 minutes. I've setup Hiawatha with Joomla multiple times and it's nothing more than a normal website using PHP and using the UrlToolkit rule for Joomla which you can copy from the howto pages.

And me joining forces with Joomla? Again, no offence, but... no way! It would be a total waste of time for both me and the Joomla team. The Banshee PHP framework is the result of my experience from working in the IT security business. I strongly believe that how Banshee is designed is a good and secure design. The only thing I would do when joining the Joomla team is making Joomla more like Banshee. But why trying to make Joomla more like Banshee when I already have Banshee? And why would the Joomla team listen to an unknown guy like me? No, I'll let the Joomla team do their thing and stay far far away from the result. I have Banshee and it's all I need from a PHP framework. The dutch IT security news website www.security.nl has been built upon the Banshee framework. And I can tell you, that website recieves a lot of attacks, but it is still up and running and has never been compromised.

The main reason why I think Joomla (and CMS'es like Wordpress and Drupal) are crap and never will be any better is because they aim at making a product which even noobs can use to make a website. And making a good and secure website simply requires knowledge. It's the same as creating a "build your own airplane" construction set and expecting that all the airplanes coming from that will be safe to fly. It's naive and stupid.

Dear Hugo,

Sorry for mis understanding me. I had to laugh because i am for 100000000 % agree with you. Otherwise why should i use your webserver?
I am from a total other background. I am an finance manager with a lot of love for IT. And certainly I beleive that security has to be number one.
It is also important in finance processes. But this discussion is not applicable in this area.

And idd my lack skills what i already mentioned is also the cause of it. Anyway..thank you for the reaction. I travel further.
Who knows our paths will cross someday

So this post is closed.

Hey Hugo,

Ik forgot to thank you very much for this secunia page! Joomla is like an open house invitation for hackers!

Two columns of red flags at the bottom of the homepage of Joomla could be seen by using an Firefox extension - RequestPolicy (https://www.requestpolicy.com/) which could be used to prevent the Cross-Site Request Forgery (CSRF) attacks.

Some websites made by Joomla, do not show the version numbers of their "Apache"s, whose users are somewhat active and speak loudly which gives some feeling of "increasing usage".

News in Dutch: http://www.security.nl/artikel/43223/1/VS_waarschuwt_voor_aanvallen_op_Joomla_en_Wordpress.html

An alternative approach is to choose the CMS'es based on the solid standalone "web application framework", for example, http://blog.dreamcss.com/content-management-system/cakephp-based-cms/

The support link at the top of the homepage, and the log files of the web server.