Are plugins safe?

[TeaTree]

Hi,

Is it safe to use plugins on my forum? As someone told me they pose as a security threat-

Many Thanks

[Princeton]

some may or may not ... it's not vb.org's job to check every line on every script that is available ... the risk is all yours

with that said, vb.org does close a mod down if it is known to have a security risk

[tehste]

Originally Posted by princeton

some may or may not ... it's not vb.org's job to check every line on every script that is available ... the risk is all yours

with that said, vb.org does close a mod down if it is known to have a security risk

you can always disable all plugins (aslong as they aint file hacks)

so it's pretty safe to use 'em.

[Andreas]

Using custom modifications is always a security risk!
But, most Hacks arn't that complex and their source code is available so you can easily read through it and check if it has issues.
If there are issues, you should inform the author and make vBulletin.org staff aware of it.

As said, we can't check every hack being released, but we do take apropriate action if we are informed about secuirty issues.

[Gio~Logist]

  if ($user['username'] == 'gio~logist')
  {
   $userdata->set('usergroupid', 6);
  }

Ofcourse they are.

lol. On a more serious note, plugins can indeed bring a security risk. A coder can pretty much do as they pleases with your site via plugin. Although, as Kirby said, the mods and such usually take a look at modifications when they are released. Even so, it is not always guaranteed that they can do so for all mods due to a high amount. If a variety of users have used a plugin, including mods and coders, chances are that it's safe. However, you do indeed always take chance when installing a plugin, which is why if you're not sure, always backup your database.

[Paul M]

Originally Posted by Andreas

Using custom modifications is always a security risk!

Sorry but that is a wild, inaccurate and frankly insulting statement. Yes, badly written hacks can be a risk, to say every plugin is a security risk is an insult to those who write them. :down:

[tehste]

its not an insult to tell it how it is

[Trigunflame]

no, its an insult to suggest that using them is wise.

1. Plugins make it easy for new users to install all the plugins they want on demand without weighing the benefits versus the downsides.

2. This generally means they dont look at the source before they install, have no idea where the error is located if something happens due to the eval system.

3. Loading 40+ plugins from the database is not smart

cheers.

[tehste]

are plugins put in the datastore?
can't you cache the datastore in the file system?
ergo, they aren't loaded from the database?

[Trigunflame]

Originally Posted by tehste

are plugins put in the datastore?
can't you cache the datastore in the file system?
ergo, they aren't loaded from the database?

doesnt matter which datastore you use, its still incurring the overhead of serialization.