CICiPHPerCoder·Feb 6, 2017
> This is something that I would love to see happen with open source projects:
That won't happen. But not for lack of trying!
My consulting company, Paragon Initiative Enterprises, has produced over a dozen high quality open source projects that make it easier to write secure PHP software.
For starters, we wrote an entire CMS that has secure automatic updates baked into its core as a first-class feature (including for extension developers): https://paragonie.com/project/airship
Worried about SQL injection? EasyDB makes it easy and intuitive to use prepared statements. https://github.com/paragonie/easydb
Need Content-Security-Policy headers quickly and easily? You want CSP-Builder: https://paragonie.com/project/csp-builder
Want all the security of libsodium with an even simpler interface and a separate class for dealing with the filesystem
Read the rest
? Check out Halite: https://paragonie.com/project/halite
Want to stop CSRF (including replay attacks)? https://github.com/paragonie/anti-csrf
Want to quickly examine the differences between two PHP Archives (e.g. for reproducible builds)? https://github.com/paragonie/pharaoh
We even wrote the community's accepted interface for generating cryptographically secure random numbers in PHP 5 projects: https://github.com/paragonie/random_compat
And coming soon (pending an audit), a pure-PHP implementation of libsodium that will likely be adopted by WordPress so its automatic updates are Ed25519 secured: https://github.com/paragonie/sodium_compat
And even more: https://paragonie.com/projects
Guess how many clients we've gotten from all this open source software we wrote over the past two years that demonstrably improves the security posture of software written in PHP?
Zero.
My solution: Our next project isn't going to be OSS, and it's unlikely that any of our future ones will be unless it's intended to be a giveaway.
The open source + consulting business model may sound good in theory, but it simply doesn't work. (Though, I will grant that it's possible that the "consulting about someone else's open source project" is more sustainable, due to near-zero investment in said project itself.)