HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
paragonie
airship
PHP2016–2017
paragonie / airship · Archived

airship

Secure Content Management for the Modern Web - "The sky is only the beginning"

Web DevelopmentSecurity & PrivacyData & Databases
Explore on GitHubRead Hacker News discussions
3Distinct people
21Mentions
0Explicit recommenders
412GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Secure Content Management for the Modern Web - "The sky is only the beginning"

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by month21 dated mentions

Observed mentions: 2016-03-28 13:16:51 UTC to 2017-07-13 19:25:37 UTC.

012342016-03-01 00:00:00 UTC to 2016-04-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsMar 20162016-04-01 00:00:00 UTC to 2016-05-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2016-05-01 00:00:00 UTC to 2016-06-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2016-06-01 00:00:00 UTC to 2016-07-01 00:00:00 UTC (exclusive): 2 mentions; 2 submissions, 0 comments2016-07-01 00:00:00 UTC to 2016-08-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments2016-08-01 00:00:00 UTC to 2016-09-01 00:00:00 UTC (exclusive): 3 mentions; 2 submissions, 1 comments2016-09-01 00:00:00 UTC to 2016-10-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2016-10-01 00:00:00 UTC to 2016-11-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2016-11-01 00:00:00 UTC to 2016-12-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsNov 20162016-12-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2017-01-01 00:00:00 UTC to 2017-02-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2017-02-01 00:00:00 UTC to 2017-03-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2017-03-01 00:00:00 UTC to 2017-04-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments2017-04-01 00:00:00 UTC to 2017-05-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2017-05-01 00:00:00 UTC to 2017-06-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2017-06-01 00:00:00 UTC to 2017-07-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2017-07-01 00:00:00 UTC to 2017-08-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsJul 2017

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Mar 20162016-03-01 00:00:00 UTC2016-04-01 00:00:00 UTC101
Apr 20162016-04-01 00:00:00 UTC2016-05-01 00:00:00 UTC101
May 20162016-05-01 00:00:00 UTC2016-06-01 00:00:00 UTC101
Jun 20162016-06-01 00:00:00 UTC2016-07-01 00:00:00 UTC220
Jul 20162016-07-01 00:00:00 UTC2016-08-01 00:00:00 UTC211
Aug 20162016-08-01 00:00:00 UTC2016-09-01 00:00:00 UTC321
Sep 20162016-09-01 00:00:00 UTC2016-10-01 00:00:00 UTC202
Oct 20162016-10-01 00:00:00 UTC2016-11-01 00:00:00 UTC101
Nov 20162016-11-01 00:00:00 UTC2016-12-01 00:00:00 UTC101
Dec 20162016-12-01 00:00:00 UTC2017-01-01 00:00:00 UTC101
Jan 20172017-01-01 00:00:00 UTC2017-02-01 00:00:00 UTC000
Feb 20172017-02-01 00:00:00 UTC2017-03-01 00:00:00 UTC000
Mar 20172017-03-01 00:00:00 UTC2017-04-01 00:00:00 UTC404
Apr 20172017-04-01 00:00:00 UTC2017-05-01 00:00:00 UTC000
May 20172017-05-01 00:00:00 UTC2017-06-01 00:00:00 UTC101
Jun 20172017-06-01 00:00:00 UTC2017-07-01 00:00:00 UTC000
Jul 20172017-07-01 00:00:00 UTC2017-08-01 00:00:00 UTC101

What Hacker News says

21 sources
CiPHPerCoder·May 30, 2017
I've tried it. I've failed at it. Halite is a libsodium wrapper for PHP projects that emphasizes ease-of-use and difficulty to misuse: https://github.com/paragonie/halite CMS Airship is a secure-by-default content management system (think WordPress, Drupal, Joomla, etc.): https://github.com/paragonie/airship Both projects are released under GPL but offer commercial licenses. In two years, I've only had one person ever inquire about a commercial license, and they backed out. One of the libraries I wrote has an installed base of (not counting WordPress) over 28 million, yet I rarely hear from its users: https://packagist.org/packages/paragonie/random_compat The barrier isn't legal or philosophical, it's that a lot of very useful open source software (especially libraries that developers interface with) are infrastructure rather than window
Read the rest
dressing, which is largely invisible to organizations. If you only develop window-dressing libraries, then the stuff 'patio11 has said here over the years might hold true. But if you're trying to build a more secure Internet by giving developers better tools, nobody wants to pay you for that.
In Ask HN: Why don't more open-source projects monetize?
CiPHPerCoder·Mar 19, 2017
> Look, you can't put up a blog post titled "How We Engineered CMS Airship to Be Simply Secure" and say that when asked "well, how did you actually engineer it to be secure?". In your post you talk about problems all solved by a framework, and apparently you haven't even evaluated what is out there already and rushed headfirst into building it all yourself. I've looked at Laravel, about two years ago. http://seclists.org/fulldisclosure/2015/Apr/57 I haven't looked deeper at what it's done since then, since nobody is paying me to do so. I wasn't impressed then, and instead of waiting for them to get around to doing things right (while figuring out how to preserve backward compatibility), I started from zero. You don't have to like that decision, but that's the decision I made. > Again, using a framework makes your code way easier to review
Read the rest
and a lot smaller to boot. Sure, use a framework. And then this happens: https://kivikakk.ee/cryptography/2016/02/20/breaking-homegro... I designed my own because, unfortunately, most of the PHP community either doesn't prioritize security enough to be trustworthy, or is simply in over their heads. We use third party libraries (Twig for templates, HTML Purifier for allowing some HTML but avoiding XSS vulnerabilities) because they're well-studied and trustworthy libraries. However, I do not trust most other PHP developers to do anything security-critical correctly. And thus, I will not design something meant to be secure based on an insecure foundation. If your only reason for Airship's status as "probably insecure" is because it's "ad-hoc" and/or "bespoke": Sorry, that's insufficient. Got a PoC handy? Otherwise: we're talking about pure hypotheticals that are far removed from the real world and there's not much point in that. You can frame your criticism as "things to make the code easier to read/understand" and whatnot, and they stand alone. Citing them as "probably a vulnerability" is questionable, however. > It's hard to tell, in this graph (https://github.com/paragonie/airship/graphs/contributors) is 'paragonie-security' a single person? For the moment, I'm the only technical person at Paragon. That will change, and that account will be delegated to signing/committing the code changes made by other employees. > As someone who works in the security industry it's just a bit tiring to see yet another homegrown PHP half-framework full of it's own intricacies and potential issues with the ever familiar problems described in all my comments above, coupled with a post saying how it was engineered to be secure from the ground up. You've raised legitimate concerns over: - Apparent NIH-syndrome, which in this case is justified - Minor code quality nits, which are now fixed - Bus factor ...but none of those are, directly, a security problem. :)
In How We Engineered CMS Airship to Be Simply Secure
orf·Mar 19, 2017
> Our cryptography is certainly superior to Laravel's... Ok, but cryptography is only a small portion of what a framework does and not necessarily the most important bit. I was asking more about your routing, view layer, ORM, code layout, templating, validation, caching, ACLs etc. > Beyond that, nobody has paid me to look deeper and I haven't had any reason to. Look, you can't put up a blog post titled "How We Engineered CMS Airship to Be Simply Secure" and say that when asked "well, how did you actually engineer it to be secure?". In your post you talk about problems all solved by a framework, and apparently you haven't even evaluated what is out there already and rushed headfirst into building it all yourself. This is not engineering a project to be "simply secure", in the sense that it is definitely not simple and probably not secure!
Read the rest
> If so, then anyone reading this thread who's aware of any vulnerabilities will be interested... This is great! I wish more companies did this. However, as stated previously, the ad-hoc nature of the code and the single-developer nature[1] makes this pretty hard to do from a code review point of view. Again, using a framework makes your code way easier to review and a lot smaller to boot. Anyone with Django experience can pick up a Django app and start to review it, rather than have to learn whatever bespoke framework the developers of the project dreamed up. Also I just wanted to add that I don't mean to come across as a dick, your project looks interesting for sure and a lot of work has gone into it. PHP CMS's need to start taking security seriously, things like Joomla and random Wordpress plugins are a blight and anything taking security seriously is great! As someone who works in the security industry it's just a bit tiring to see yet another homegrown PHP half-framework full of it's own intricacies and potential issues with the ever familiar problems described in all my comments above, coupled with a post saying how it was engineered to be secure from the ground up. 1. It's hard to tell, in this graph (https://github.com/paragonie/airship/graphs/contributors) is 'paragonie-security' a single person?
In How We Engineered CMS Airship to Be Simply Secure
CiPHPerCoder·Mar 19, 2017
Thank you for taking the time to look through the code. 1. Context matters: That's a CLI script used to build and sign core updates. We bundle it with the source code so anyone can fork our project and use only their own keys, easily. 2-4. This is a good point. https://github.com/paragonie/airship/issues/181 > Properly escaping SQL injection is great (and something PHP apps seem to have a continual problem with), but why did you decide to roll your own framework for doing this? Because when Airship was started, everyone insisted on backwards compatibility for PHP 5 and I wanted to make use of strict typing. The master branch includes a static analyzer as part of continuous integration. > Are all of the well maintained, tested and great ones already available not suitable for some reason? Have you seen what I've done to PHP frameworks over
Read the rest
the years? https://scott.arciszewski.me/open-source/ https://paragonie.com/security/advisories I wasn't in a hurry to pick up other peoples' technical debt, especially if we're paying money for vulnerabilities: https://hackerone.com/paragonie 5. That's simply a paranoia/convenience feature. If you've got a better way to automagically convert filename.txt into filename-5.txt if filename.txt, filename-2.txt, filename-3.txt, and filename-4.txt already exist, I'm all ears. 6-10. Good eye. I think that can be refactored to repeat itself less. 11. I don't see a problem with this? 12. I don't see a problem with this either.
In How We Engineered CMS Airship to Be Simply Secure
orf·Mar 19, 2017
After a quick peruse of their github repository I have to say there is some dodgy[1] stuff going on. As ever with PHP sites validation seems to be a mess. For example we've got a `escapeSupplierName` function[2] used in some places[3], but a different regex used when creating a suppier[4]. Variants of that regex also appear all over the code, why not put it in a single place? Properly escaping SQL injection is great (and something PHP apps seem to have a continual problem with), but why did you decide to roll your own framework for doing this? Are all of the well maintained, tested and great ones already available not suitable for some reason? It's just your app turns into a hard to check, inefficient[5] sludge, full of lots of code for handling framework related things like an ORM, caching[6] (that code is practically duplicated in a lot
Read the rest
of places[7][8][9][10]), escaping[11], mime whitelisting[12] etc and not much about a CMS. This is where security bugs appear. 1. https://github.com/paragonie/airship/blob/eb4293aee5be59e329... 2. https://github.com/paragonie/airship/blob/c4c9384d4d7860738d... 3. https://github.com/paragonie/airship/blob/c4c9384d4d7860738d... 4. https://github.com/paragonie/airship/blob/95af23ca782e8ecb10... 5. https://github.com/paragonie/airship/blob/63cf0661ba21cbb3f3... 6. https://github.com/paragonie/airship/blob/master/src/view_fu... 7. https://github.com/paragonie/airship/blob/master/src/view_fu... 8. https://github.com/paragonie/airship/blob/master/src/view_fu... 9. https://github.com/paragonie/airship/blob/63cf0661ba21cbb3f3... 10. https://github.com/paragonie/airship/blob/2a8a87934921ecda85... 11. https://github.com/paragonie/airship/blob/eb4638eb31510028f4... 12. https://github.com/paragonie/airship/blob/eb4638eb31510028f4...
In How We Engineered CMS Airship to Be Simply Secure
CiPHPerCoder·Dec 29, 2016
If you have a designer who's worked with templating engines in other languages (e.g. Django/Python projects), they already know what they're doing. It also makes it easier to separate your presentation logic from your business logic. For example: https://github.com/paragonie/airship/blob/master/src/Cabin/B... This uses macros and other fun things. Doing that in PHP would get messy. https://github.com/paragonie/airship/blob/master/src/Cabin/B...
In Who’s on Your 2016 Web Development Thank You List?
CiPHPerCoder·Nov 1, 2016
CMS Airship (https://github.com/paragonie/airship) is a PHP CMS that aims to be secure-by-default. To this end, we pinned our minimum version to PHP 7 (for type safety and ease of static analysis) and built our cryptographic security features on top of libsodium. What cryptographic security features? In addition to the standard fare (e.g. password hashing), we offer secure automatic security updates. We'd like to set the new gold standard for website security. To see how Airship differs from other CMS platforms, consult this comparison chart of out-of-the-box security features: https://paragonie.com/project/airship We'll be releasing version 1.4.0 soon, then shifting gears towards a version 2 (with a minimum PHP version of 7.1) later this month. This means backwards incompatible changes are on the table for discussion. Although our team h
Read the rest
as a lot of great security talent, we're not UI/UX experts. We're doing the best we can, but we almost certainly need help in this area first and foremost. https://github.com/paragonie/airship/blob/master/.github/CON... CMS Airship is GPL3 licensed, although we offer commercial licenses (under terms equivalent to the MIT license). Any revenue we receive from commercial license agreements will inevitably be funneled into hiring talented developers to improve the areas we're weak in and make Airship better.
In Ask HN: Who needs contributors? (November 2016)
CiPHPerCoder·Oct 3, 2016
CMS Airship (https://github.com/paragonie/airship) CMS Airship is a secure-by-default content management system, blog engine, and application development framework written in PHP 7. We want to move the overton window of PHP applications towards being secure out-of-the-box. Despite our focus on security, there are a lot of ways to contribute even if you're not a security expert: https://cspr.ng/blog/2016/09/contribute-airship-non-expert-s... > What do you hope to build this month? This is what I'll be doing this month: - Facilitate data import from WordPress, etc. - Create a workflow for deleting user accounts. - Make the extension development tools easier to use. In the slightly-longer term, I'm building an extension that adds e-commerce capabilities, in case anyone wants to migrate from WooCommerce, Magento, or OpenCart. > What ki
Read the rest
nd of skills do you need? I'm pretty terrible at UI/design work. If anyone has front-end chops, I'd greatly appreciate any actionable feedback you can offer. The documentation (https://github.com/paragonie/airship-docs) isn't complete, and I need to find time to work on that. If anyone can, please help here. > Links IRC: #airship on irc.freenode.net Reddit: /r/cmsAirship Github: - https://github.com/paragonie/airship - https://github.com/paragonie/airship-docs Example website: https://cspr.ng License: GPL 3
In Ask HN: Who needs contributors? (October 2016)
CiPHPerCoder·Sep 7, 2016
As of WordPress 4.4.0, wp_rand() is fine. https://paragonie.com/blog/2015/10/coming-wordpress-4-4-cspr... I had already suggested (to Dion Hulse) that this antipattern of pinging wordpress.org to define the salts during setup be removed in favor of always generating them locally. I don't know if/when they'll implement that (no matter what benefits a security fix might provide, WordPress always prioritizes "no BC breaks even on 0.0001% of the installed base" first), but if you're looking for a more secure CMS I happen to be building one here: https://github.com/paragonie/airship
In How to Generate Secure Random Numbers in Various Programming Languages
CiPHPerCoder·Sep 2, 2016
CMS Airship Github: https://github.com/paragonie/airship Docs: https://github.com/paragonie/airship-docs Airship is a secure-by-default CMS that applies security fixes within one hour of their release by our team in the default configuration. Code delivery is secured by cryptographic signatures, a system similar to certificate transparency, and reproducible builds from open source components. License: GPL Language(s) Used: PHP (version 7 with strict types) Twig templates SQL (currently only PostgreSQL 9.5) JavaScript jQuery HTML5 / CSS3 (with no regard for legacy IE compatibility) How to help: https://cspr.ng/blog/2016/09/contribute-airship-non-expert-s... Some more technical details in case HN is interested: https://paragonie.com/blog/2016/05/keyggdrasil-continuum-cry... | How the auto-updater works (warning: cryptograph
Read the rest
y protocols ahead) https://paragonie.com/blog/2016/06/php-security-platinum-sta... | The version 1.0.0 blog post https://paragonie.com/blog/2016/08/on-insecurity-popular-ope... | A comparison of the security of three most popular CMS platforms
In Ask HN: Who needs contributors?
CiPHPerCoder·Aug 18, 2016Submission

Ask HN: Learning better web design practices?

Hi HN, I've started a Free Software project that aims to be secure. The feedback I've received was mostly positive, but the negative feedback was very nondescript. Source code: https://github.com/paragonie/airship Example website: https://cspr.ng I've been told, "This looks like something out of the 1990's," etc. but none of the UI criticism received was actionable by any stretch of the imagination. What are some resources to learn better web design?
2 points · Open discussion
CiPHPerCoder·Jul 12, 2016
I worked on an open source CMS called Airship and we decided to include 2FA in our v1.0 release. After a bit of research (mostly to conclusively rule out SMS-based 2FA), I found that it was actually very easy to implement. I started working on a vendor-agnostic 2FA implementation for PHP projects. https://github.com/paragonie/multi_factor It's far from complete, but hopefully it makes it easier for others to add 2FA to their projects. If anyone's interested in the open source CMS I mentioned: https://github.com/paragonie/airship
In Two Factor Auth List of Websites

Showing the 15 most recent of 21 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.