Neal Poole

>And it turns out to work incredibly well for the most part. It's serverless by design!

Worked incredibly well compared to what? CGI was a performance nightmare, forking per request. CGI and FastCGI have both been a security nightmare. HTTPoxy, Shellshock, Pathinfo, and more. Setting up PHP correctly is cumbersome and depends on a complex interaction between sometimes confusing php.ini options and fairly complex configurations with your webserver. Check out, for example, this article on configuring PHP properly with Nginx:

https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/

So other than that, yes, it worked. Incredibly well? Not compared to application servers which don't have the kinds of vulnerabilities and configuration complexities caused by the weird impedance mismatch between webservers and FastCGI workers.

The jab about serverless is really condescending and unrelated, but I feel it necessary to point out that I am not really especially a proponent of serverless as it is today. I much prefer long-running application servers. PHP-FPM gives you a bit of both worlds, a combination of them that is far from ideal in my opinion.

>Again, I don't see how this is a problem. Routing is likely to be the most trivial part of your app, but it's also tied to business logic and should (IMO) be part of the checked-in code.

I am having difficulty responding to this because I think you misunderstood what I meant.…

Definitely. Paying such a small amount, especially in credit that can only be redeemed in a company store, is patronizing and gets you mentioned in a negative light on Hacker News. If you don't pay, you're just like one of the many companies that doesn't have a bounty program.

Edit: this reminds me of the "eBay goodies" offered to researcher Neal Poole in return for delaying disclosure of a vulnerability [https://nealpoole.com/blog/2013/03/bad-changes-to-ebays-responsible-disclosure-policy/]. I would probably not have remembered that story if not for that "eBay goodies" line, just as I probably won't forget this story thanks to the screenshot of Yahoo-branded socks in the company store.

That configuration contains a major security vulnerability, at least if your site allows file uploads (I tested it on my server to be sure). I've written about this issue before: https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/

Edit: You need to copy the try_files line into the PHP location block. I'd recommend using the following line (I just added =403 to the end of yours, so you return a 403 error rather than a 500 error when try_files fails):

try_files $uri $uri/ /index.php?$query_string =403;

Some blogs I like (most are not updated very frequently, though):

Billy Rios (discovered GIFAR) http://xs-sniper.com/blog/

Michal Zalewski (one of the top security researchers in the world, wrote "The Tangled Web", a must-read) http://lcamtuf.blogspot.com

Neal Poole: https://nealpoole.com/blog/

Nir Goldshlager: http://www.nirgoldshlager.com/

Michael Brooks: https://sitewatch.me/en/Blog

Nils Jünemann: http://www.nilsjuenemann.de/

Stefano di Paola (Minded Security): http://blog.mindedsecurity.com/

Root Labs: http://rdist.root.org/

There was a bit of chatter recently about ill-configured nginx-fastcgi servers having a php vulnerability. Seems to be summed up here:

https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/

Thanks for the keep-alive tip. I missed that one.

EDIT: I see that the author of the post I linked replied below- also with the link.