I’ve been a loyal customer of Bluehost for years now. Their systems are fast; their offerings are great. Today, however, I’m wondering how they ever got to be in the business with the kind of mistakes I’ve found.
Overwrote my php.ini
For those who don’t know what a php.ini file is, it’s a very important configuration file for PHP. If you want to set whether errors get displayed, which directories you want in your include path, etc. These are both options that I set in my php.ini:
I’ve put my custom libraries outside of the web-accessible path, in the odd case that there’s a system problem and the code gets exposed. More importantly, however, I can have a single require_once(‘library.php’), and regardless of the path I’ll be able to get the file within that include directory.
I also changed the default error behavior, to disallow PHP errors to be displayed on the page itself. This again is a security measure, since otherwise there’s a reasonable amount of information about the system that can get leaked out by these error messages. They should be in a private log, not searchable via Google.
Imagine my dismay, then, when I find that my site has been broken since this past Sunday (Friday, today) because both of these directives were completely overwritten by Bluehost. I never received an email, nor any sort of communication before or after the fact. I was on the support line for 27 minutes and 53 seconds, after which I received a suggestion that not all users are quite as picky as myself, and that I can send an email to their feedback line if I wanted to voice my opinion.
I’m opting for this instead.
My only real evidence of any sort of problem was, and is, the modification time of the php.ini file, and another file titled “php.ini.NEWCONFIGPOSSIBLYBROKEN”. Oh, and masses of error logs; and the site showing PHP errors rather than content.
Passwords in the clear?
So of course, that wasn’t the whole story. There’s also Bluehost’s support contact page, which is a gem in of itself. In order to see the nasty bits, you’ll have to click one of the various support options and hit the button at the bottom of the form. In there lies a rather special field:
Last 4 Characters of Password (not credit card):
Really? ! Upon mentioning this to the tech on the support line, he assured me that the system is entirely safe. No one can read your passwords; they have a script which takes your input and then gives an answer. He wasn’t sure how it worked, though he claimed to know it was not a security problem.
It is possible that the system is storing two independent hashes, one for the entire password and secondly for what’d be substr($password,-4);. I seriously hope that’s the case, because any other alternatives that I can dream up seem to point to storing the system passwords in plain text. I do hope that they are not that stupid. My confidence is just a little bit shaken, however, by their inability to forsee other problems, such as described in the upper half of this post.
Taking a deep breath
Aside from today, I’ve never had a problem with Bluehost. I know they have a huge number of clients, and that alone is not an easy job to undertake. Their MySQL performance and support for multiple domains make me want to stick with them; on top of the fact that I already bought three years of service from them, of which I have two left..
With that said, systems are incredibly important, and these kinds of mistakes are not representative of a company which knows what its doing. Luckily they had backups of my old php.ini — and because I knew where to find it, I was able to get my site running again. Sans that, however, there was no trace of my configuration. That simply is not cool. I sincerely hope that they, along with all other providers, take the proper steps to help developers; not those which send them up a creek without a paddle.
