1. WordPress by default puts the full version number in the metadata, similar to what we do ( <meta name="generator" content="Joomla! 1.5 - Open Source Content Management" />) except with the full version (for example 1.5.23). 2. WordPress notifies Google when a new version is released or when an old version reaches end of life. 3. When the Google crawler finds a site that should be updated and is registered in Webmaster Tools, Google sends a message via Webmaster Tools to the site admin notifying them that the site should be updated. (If the site is not registered with Webmaster Tools, nothing happens.)
One important advantage of this approach is that site admins can have their Webmaster Tools messages forwarded to them via email. So they can be notified about updates without having to visit or log in to the sites.
The only change we would need to do to enable this would be to put the full version in a meta element. Some people have expressed concern that this is a security risk. Google and WordPress (and most security people I've talked to) think the benefits of update notification are far greater than any risk. (Evidently most hackers just try to run an exploit and don't bother checking for software versions. Also the full version number is already exposed in the administrator/manifests/files/joomla.xml file.)
The PLT thinks it would be a good thing to do. If enough people are concerned about it, we could add a global configuration parameter that would allow people to not expose the version. Even without a parameter, anyone could write a simple plugin to alter or remove the metadata.
My first choice would be to simply add the version number in the metadata without another parameter. My second choice would be to add it in with a parameter (with a default value of showing the version number).
Like it. Maybe the best way would be to add a global parameter that adds/removes the whole generator tag. Or go a step further and make it a super simply plugin that you can enable/disable. Enabled by default.
> 1. WordPress by default puts the full version number in the metadata, > similar to what we do ( > <meta name="generator" content="Joomla! 1.5 - Open Source Content > Management" />) except with the full version (for example 1.5.23). > 2. WordPress notifies Google when a new version is released or when an > old version reaches end of life. > 3. When the Google crawler finds a site that should be updated and is > registered in Webmaster Tools, Google sends a message via Webmaster > Tools to the site admin notifying them that the site should be > updated. (If the site is not registered with Webmaster Tools, nothing > happens.)
> One important advantage of this approach is that site admins can have > their Webmaster Tools messages forwarded to them via email. So they > can be notified about updates without having to visit or log in to the > sites.
> The only change we would need to do to enable this would be to put the > full version in a meta element. Some people have expressed concern > that this is a security risk. Google and WordPress (and most security > people I've talked to) think the benefits of update notification are > far greater than any risk. (Evidently most hackers just try to run an > exploit and don't bother checking for software versions. Also the full > version number is already exposed in the > administrator/manifests/files/joomla.xml file.)
> The PLT thinks it would be a good thing to do. If enough people are > concerned about it, we could add a global configuration parameter that > would allow people to not expose the version. Even without a > parameter, anyone could write a simple plugin to alter or remove the > metadata.
> My first choice would be to simply add the version number in the > metadata without another parameter. My second choice would be to add > it in with a parameter (with a default value of showing the version > number).
> What do other people think about this? Thanks.
> Mark Dexter > -- > You received this message because you are subscribed to the Google > Groups "Joomla! CMS Development" group. > To post to this group, send an email to joomla-dev-cms@googlegroups.com. > To unsubscribe from this group, send email to > joomla-dev-cms+unsubscribe@googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
> Like it. Maybe the best way would be to add a global parameter that > adds/removes the whole generator tag. Or go a step further and make it a > super simply plugin that you can enable/disable. Enabled by default.
> Hannes
> Am 09.02.2012 17:28, schrieb Mark Dexter: > > Hi everyone. The folks at Google who are responsible for the Google > > Webmaster Tools (http://support.google.com/webmasters/?hl=en) have > > asked us if we want to enable an update notification process for our > > mutual users. They have been doing this for a few years with > > WordPress. Here is a link with some background information:
> > 1. WordPress by default puts the full version number in the metadata, > > similar to what we do ( > > <meta name="generator" content="Joomla! 1.5 - Open Source Content > > Management" />) except with the full version (for example 1.5.23). > > 2. WordPress notifies Google when a new version is released or when an > > old version reaches end of life. > > 3. When the Google crawler finds a site that should be updated and is > > registered in Webmaster Tools, Google sends a message via Webmaster > > Tools to the site admin notifying them that the site should be > > updated. (If the site is not registered with Webmaster Tools, nothing > > happens.)
> > One important advantage of this approach is that site admins can have > > their Webmaster Tools messages forwarded to them via email. So they > > can be notified about updates without having to visit or log in to the > > sites.
> > The only change we would need to do to enable this would be to put the > > full version in a meta element. Some people have expressed concern > > that this is a security risk. Google and WordPress (and most security > > people I've talked to) think the benefits of update notification are > > far greater than any risk. (Evidently most hackers just try to run an > > exploit and don't bother checking for software versions. Also the full > > version number is already exposed in the > > administrator/manifests/files/joomla.xml file.)
> > The PLT thinks it would be a good thing to do. If enough people are > > concerned about it, we could add a global configuration parameter that > > would allow people to not expose the version. Even without a > > parameter, anyone could write a simple plugin to alter or remove the > > metadata.
> > My first choice would be to simply add the version number in the > > metadata without another parameter. My second choice would be to add > > it in with a parameter (with a default value of showing the version > > number).
> > What do other people think about this? Thanks.
> > Mark Dexter > > -- > > You received this message because you are subscribed to the Google > > Groups "Joomla! CMS Development" group. > > To post to this group, send an email to joomla-dev-cms@googlegroups.com. > > To unsubscribe from this group, send email to > > joomla-dev-cms+unsubscribe@googlegroups.com. > > For more options, visit this group at > > http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
> -- > You received this message because you are subscribed to the Google Groups > "Joomla! CMS Development" group. > To post to this group, send an email to joomla-dev-cms@googlegroups.com. > To unsubscribe from this group, send email to > joomla-dev-cms+unsubscribe@googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
I do find it amusing that we just went trough quite a bit of trouble with 2.5.0 and 2.5.1 to hide the version number for unauthorised vistors.
On 09.02.2012, at 19:55, Hannes Papenberg wrote:
> Like it. Maybe the best way would be to add a global parameter that > adds/removes the whole generator tag. Or go a step further and make it a > super simply plugin that you can enable/disable. Enabled by default.
There are already extensions out there that allow you to hide the generator tag, I don't see why we have to suck it into the core.
How would this affect security for sites that are not regularly updated by their owners? Would this be a potential risk for making the sites an easier target for those exploiting vulnerabilities?
[mailto:joomla-dev-cms@googlegroups.com] On Behalf Of Rouven Weßling Sent: Thursday, February 09, 2012 1:05 PM To: joomla-dev-cms@googlegroups.com Subject: Re: [jcms] Joomla Version Number and Google Webmaster Tools
I'm also in favor.
I do find it amusing that we just went trough quite a bit of trouble with 2.5.0 and 2.5.1 to hide the version number for unauthorised vistors.
On 09.02.2012, at 19:55, Hannes Papenberg wrote:
> Like it. Maybe the best way would be to add a global parameter that > adds/removes the whole generator tag. Or go a step further and make it > a super simply plugin that you can enable/disable. Enabled by default.
There are already extensions out there that allow you to hide the generator tag, I don't see why we have to suck it into the core.
Rouven
-- You received this message because you are subscribed to the Google Groups "Joomla! CMS Development" group. To post to this group, send an email to joomla-dev-cms@googlegroups.com. To unsubscribe from this group, send email to joomla-dev-cms+unsubscribe@googlegroups.com. For more options, visit this group at http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
The more I think about this, I feel there are better ways of achieving the exact same thing internally on the site itself. I'm going to use Akeeba Backup as an example. It has a built in update email notification. So when there is a new version of Akeeba Backup then the site sends an email to the site administrator notifying then that a new update is available. This is a very nice feature. Why couldn't the CMS have an update notification plugin that works in a cronless manner and is just triggered when the site gets a visit and then sends out the email notifications that there is an update available.
[mailto:joomla-dev-cms@googlegroups.com] On Behalf Of Rouven Weßling Sent: Thursday, February 09, 2012 1:05 PM To: joomla-dev-cms@googlegroups.com Subject: Re: [jcms] Joomla Version Number and Google Webmaster Tools
I'm also in favor.
I do find it amusing that we just went trough quite a bit of trouble with 2.5.0 and 2.5.1 to hide the version number for unauthorised vistors.
On 09.02.2012, at 19:55, Hannes Papenberg wrote:
> Like it. Maybe the best way would be to add a global parameter that > adds/removes the whole generator tag. Or go a step further and make it > a super simply plugin that you can enable/disable. Enabled by default.
There are already extensions out there that allow you to hide the generator tag, I don't see why we have to suck it into the core.
Rouven
-- You received this message because you are subscribed to the Google Groups "Joomla! CMS Development" group. To post to this group, send an email to joomla-dev-cms@googlegroups.com. To unsubscribe from this group, send email to joomla-dev-cms+unsubscribe@googlegroups.com. For more options, visit this group at http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
On Thu, Feb 9, 2012 at 2:08 PM, Mike Carson <m...@itdwebdesign.com> wrote: > How would this affect security for sites that are not regularly updated by > their owners? Would this be a potential risk for making the sites an > easier target for those exploiting vulnerabilities?
> The more I think about this, I feel there are better ways of achieving the > exact same thing internally on the site itself. > I'm going to use Akeeba Backup as an example. It has a built in update > email notification. So when there is a new version of Akeeba Backup then > the site sends an email to the site administrator notifying then that a > new update is available. This is a very nice feature. Why couldn't the CMS > have an update notification plugin that works in a cronless manner and is > just triggered when the site gets a visit and then sends out the email > notifications that there is an update available.
> Regards, > Mike Carson
> -----Original Message----- > From: joomla-dev-cms@googlegroups.com > [mailto:joomla-dev-cms@googlegroups.com] On Behalf Of Rouven We�ling > Sent: Thursday, February 09, 2012 1:05 PM > To: joomla-dev-cms@googlegroups.com > Subject: Re: [jcms] Joomla Version Number and Google Webmaster Tools
> I'm also in favor.
> I do find it amusing that we just went trough quite a bit of trouble with > 2.5.0 and 2.5.1 to hide the version number for unauthorised vistors.
> On 09.02.2012, at 19:55, Hannes Papenberg wrote:
>> Like it. Maybe the best way would be to add a global parameter that >> adds/removes the whole generator tag. Or go a step further and make it >> a super simply plugin that you can enable/disable. Enabled by default.
> There are already extensions out there that allow you to hide the > generator tag, I don't see why we have to suck it into the core.
> Rouven
> -- > You received this message because you are subscribed to the Google Groups > "Joomla! CMS Development" group. > To post to this group, send an email to joomla-dev-cms@googlegroups.com. > To unsubscribe from this group, send email to > joomla-dev-cms+unsubscribe@googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
One of the good points of the webmaster tools is that the webmaster doesn't need to visit the site to get the message. There are webmasters out there maintaining numerous sites where they don't normally need to visit the backend.
In answer to your first question Mark wrote in his original message:
"Some people have expressed concern that this is a security risk. Google and WordPress (and most security people I've talked to) think the benefits of update notification are far greater than any risk. (Evidently most hackers just try to run an exploit and don't bother checking for software versions. Also the full version number is already exposed in the administrator/manifests/files/joomla.xml file.)"
> The more I think about this, I feel there are better ways of achieving the > exact same thing internally on the site itself. > I'm going to use Akeeba Backup as an example. It has a built in update > email notification. So when there is a new version of Akeeba Backup then > the site sends an email to the site administrator notifying then that a > new update is available. This is a very nice feature. Why couldn't the CMS > have an update notification plugin that works in a cronless manner and is > just triggered when the site gets a visit and then sends out the email > notifications that there is an update available.
> Regards, > Mike Carson
> -----Original Message----- > From: joomla-dev-cms@googlegroups.com > [mailto:joomla-dev-cms@googlegroups.com] On Behalf Of Rouven Weßling > Sent: Thursday, February 09, 2012 1:05 PM > To: joomla-dev-cms@googlegroups.com > Subject: Re: [jcms] Joomla Version Number and Google Webmaster Tools
> I'm also in favor.
> I do find it amusing that we just went trough quite a bit of trouble with > 2.5.0 and 2.5.1 to hide the version number for unauthorised vistors.
> On 09.02.2012, at 19:55, Hannes Papenberg wrote:
>> Like it. Maybe the best way would be to add a global parameter that >> adds/removes the whole generator tag. Or go a step further and make it >> a super simply plugin that you can enable/disable. Enabled by default.
> There are already extensions out there that allow you to hide the > generator tag, I don't see why we have to suck it into the core.
> Rouven
> -- > You received this message because you are subscribed to the Google Groups > "Joomla! CMS Development" group. > To post to this group, send an email to joomla-dev-cms@googlegroups.com. > To unsubscribe from this group, send email to > joomla-dev-cms+unsubscribe@googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
> -- > You received this message because you are subscribed to the Google Groups "Joomla! CMS Development" group. > To post to this group, send an email to joomla-dev-cms@googlegroups.com. > To unsubscribe from this group, send email to joomla-dev-cms+unsubscribe@googlegroups.com. > For more options, visit this group at http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
I’m sure there are pros and cons about how you do this in any manner.
The site has to do a call home to somewhere to check version numbers no matter what way you implement it.
I think it’s worth discussing though. And personally I think that we need to keep security as a number one concern with making it easy to find out the version number of any given site.
Regards, Mike Carson
*From:* joomla-dev-cms@googlegroups.com [mailto: joomla-dev-cms@googlegroups.com] *On Behalf Of *Ken Ballou *Sent:* Thursday, February 09, 2012 1:16 PM *To:* joomla-dev-cms@googlegroups.com *Subject:* Re: [jcms] Joomla Version Number and Google Webmaster Tools
Wouldn't a busy site hammer the update server hard with requests to check for an updated version?
On 2/9/2012 2:13 PM, Mike Carson wrote:
The more I think about this, I feel there are better ways of achieving the
exact same thing internally on the site itself.
I'm going to use Akeeba Backup as an example. It has a built in update
email notification. So when there is a new version of Akeeba Backup then
the site sends an email to the site administrator notifying then that a
new update is available. This is a very nice feature. Why couldn't the CMS
have an update notification plugin that works in a cronless manner and is
just triggered when the site gets a visit and then sends out the email
-- You received this message because you are subscribed to the Google Groups "Joomla! CMS Development" group. To post to this group, send an email to joomla-dev-cms@googlegroups.com. To unsubscribe from this group, send email to joomla-dev-cms+unsubscribe@googlegroups.com. For more options, visit this group at http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
@Mike: I agree that email notification would be a good feature to look at for core. I think it could be done with a CLI application running from a cron job. However, I don't think that would be a reason not to implement the proposed Google method as well. The more ways we have to let people know about updates, the better in my opinion.
@Ken: With the present update check, we only check the site once per day.
As far as doing this with a plugin, we could certainly do that but it seems like a lot of code and fuss for such a small thing.
On Thu, Feb 9, 2012 at 11:22 AM, Mike Carson <m...@itdwebdesign.com> wrote: > I’m sure there are pros and cons about how you do this in any manner.
> The site has to do a call home to somewhere to check version numbers no > matter what way you implement it.
> I think it’s worth discussing though. And personally I think that we need > to keep security as a number one concern with making it easy to find out > the version number of any given site.
> Regards, > Mike Carson
> *From:* joomla-dev-cms@googlegroups.com [mailto: > joomla-dev-cms@googlegroups.com] *On Behalf Of *Ken Ballou > *Sent:* Thursday, February 09, 2012 1:16 PM
> *To:* joomla-dev-cms@googlegroups.com > *Subject:* Re: [jcms] Joomla Version Number and Google Webmaster Tools
> Wouldn't a busy site hammer the update server hard with requests to check > for an updated version?
> On 2/9/2012 2:13 PM, Mike Carson wrote:
> The more I think about this, I feel there are better ways of achieving the
> exact same thing internally on the site itself.
> I'm going to use Akeeba Backup as an example. It has a built in update
> email notification. So when there is a new version of Akeeba Backup then
> the site sends an email to the site administrator notifying then that a
> new update is available. This is a very nice feature. Why couldn't the CMS
> have an update notification plugin that works in a cronless manner and is
> just triggered when the site gets a visit and then sends out the email
> notifications that there is an update available.
> Regards,
> Mike Carson
> -----Original Message-----
> From: joomla-dev-cms@googlegroups.com
> [mailto:joomla-dev-cms@googlegroups.com <joomla-dev-cms@googlegroups.com>] On Behalf Of Rouven Weßling
> Sent: Thursday, February 09, 2012 1:05 PM
> To: joomla-dev-cms@googlegroups.com
> Subject: Re: [jcms] Joomla Version Number and Google Webmaster Tools
> I'm also in favor.
> I do find it amusing that we just went trough quite a bit of trouble with
> 2.5.0 and 2.5.1 to hide the version number for unauthorised vistors.
> On 09.02.2012, at 19:55, Hannes Papenberg wrote:
> Like it. Maybe the best way would be to add a global parameter that
> adds/removes the whole generator tag. Or go a step further and make it
> a super simply plugin that you can enable/disable. Enabled by default.
> There are already extensions out there that allow you to hide the
> generator tag, I don't see why we have to suck it into the core.
> Rouven
> --
> You received this message because you are subscribed to the Google Groups
> "Joomla! CMS Development" group.
> To post to this group, send an email to joomla-dev-cms@googlegroups.com.
> -- > You received this message because you are subscribed to the Google Groups > "Joomla! CMS Development" group. > To post to this group, send an email to joomla-dev-cms@googlegroups.com. > To unsubscribe from this group, send email to > joomla-dev-cms+unsubscribe@googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
> -- > You received this message because you are subscribed to the Google Groups > "Joomla! CMS Development" group. > To post to this group, send an email to joomla-dev-cms@googlegroups.com. > To unsubscribe from this group, send email to > joomla-dev-cms+unsubscribe@googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
I'm not talking about a plugin to hide it, but to remove that completely from the core (I think its in JDocumentHTML) and instead add the tag with that plugin. So if you want to hide the generator tag, you simply disable that plugin, instead of adding a new plugin. The version number would just be a fixed part of that tag. Am 09.02.2012 20:04 schrieb "Rouven Weßling" <m...@rouvenwessling.de>:
> I do find it amusing that we just went trough quite a bit of trouble with > 2.5.0 and 2.5.1 to hide the version number for unauthorised vistors.
> On 09.02.2012, at 19:55, Hannes Papenberg wrote:
> > Like it. Maybe the best way would be to add a global parameter that > > adds/removes the whole generator tag. Or go a step further and make it a > > super simply plugin that you can enable/disable. Enabled by default.
> There are already extensions out there that allow you to hide the > generator tag, I don't see why we have to suck it into the core.
> Rouven
> -- > You received this message because you are subscribed to the Google Groups > "Joomla! CMS Development" group. > To post to this group, send an email to joomla-dev-cms@googlegroups.com. > To unsubscribe from this group, send email to > joomla-dev-cms+unsubscribe@googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
If Google crawls your site, sees the version and sends you a reminder, no one has to do any more work than currently is done. Neither your site would "phone home" nor would you query Joomla.org. Am 09.02.2012 20:22 schrieb "Mike Carson" <m...@itdwebdesign.com>:
> I’m sure there are pros and cons about how you do this in any manner.
> The site has to do a call home to somewhere to check version numbers no > matter what way you implement it.
> I think it’s worth discussing though. And personally I think that we need > to keep security as a number one concern with making it easy to find out > the version number of any given site.
> Regards, > Mike Carson
> *From:* joomla-dev-cms@googlegroups.com [mailto: > joomla-dev-cms@googlegroups.com] *On Behalf Of *Ken Ballou > *Sent:* Thursday, February 09, 2012 1:16 PM > *To:* joomla-dev-cms@googlegroups.com > *Subject:* Re: [jcms] Joomla Version Number and Google Webmaster Tools
> Wouldn't a busy site hammer the update server hard with requests to check > for an updated version?
> On 2/9/2012 2:13 PM, Mike Carson wrote:
> The more I think about this, I feel there are better ways of achieving the
> exact same thing internally on the site itself.
> I'm going to use Akeeba Backup as an example. It has a built in update
> email notification. So when there is a new version of Akeeba Backup then
> the site sends an email to the site administrator notifying then that a
> new update is available. This is a very nice feature. Why couldn't the CMS
> have an update notification plugin that works in a cronless manner and is
> just triggered when the site gets a visit and then sends out the email
> notifications that there is an update available.
> Regards,
> Mike Carson
> -----Original Message-----
> From: joomla-dev-cms@googlegroups.com
> [mailto:joomla-dev-cms@googlegroups.com <joomla-dev-cms@googlegroups.com>] On Behalf Of Rouven Weßling
> Sent: Thursday, February 09, 2012 1:05 PM
> To: joomla-dev-cms@googlegroups.com
> Subject: Re: [jcms] Joomla Version Number and Google Webmaster Tools
> I'm also in favor.
> I do find it amusing that we just went trough quite a bit of trouble with
> 2.5.0 and 2.5.1 to hide the version number for unauthorised vistors.
> On 09.02.2012, at 19:55, Hannes Papenberg wrote:
> Like it. Maybe the best way would be to add a global parameter that
> adds/removes the whole generator tag. Or go a step further and make it
> a super simply plugin that you can enable/disable. Enabled by default.
> There are already extensions out there that allow you to hide the
> generator tag, I don't see why we have to suck it into the core.
> Rouven
> --
> You received this message because you are subscribed to the Google Groups
> "Joomla! CMS Development" group.
> To post to this group, send an email to joomla-dev-cms@googlegroups.com.
> -- > You received this message because you are subscribed to the Google Groups > "Joomla! CMS Development" group. > To post to this group, send an email to joomla-dev-cms@googlegroups.com. > To unsubscribe from this group, send email to > joomla-dev-cms+unsubscribe@googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
> -- > You received this message because you are subscribed to the Google Groups > "Joomla! CMS Development" group. > To post to this group, send an email to joomla-dev-cms@googlegroups.com. > To unsubscribe from this group, send email to > joomla-dev-cms+unsubscribe@googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
> How would this affect security for sites that are not regularly updated by > their owners? Would this be a potential risk for making the sites an > easier target for those exploiting vulnerabilities?
On these sites, the plugin can be disabled. The benefit of these alerts are greater than the risk.
> @Mike: I agree that email notification would be a good feature to look > at for core. I think it could be done with a CLI application running > from a cron job. However, I don't think that would be a reason not to > implement the proposed Google method as well. The more ways we have to > let people know about updates, the better in my opinion.
> @Ken: With the present update check, we only check the site once per day.
This is true, but I thought the proposal was to check for an update *every time the site gets a visitor.* Perhaps I misunderstood?
OK I do agree with you that the more way of notifying people, the better. But let’s be realistic here, people are LAZY! If they are too lazy to sign up for the security mailing list on the download page of Joomla.org where notifications get sent out, then the chances are also extremely high that they are also going to be too lazy to sign up for the Google notifications as well. I think that if we lived in a euphoric world where everyone took advantage of all the notification efforts that have been put in place then we wouldn’t have to worry about it. But reality is that some people need to be hit upside the head with a 2x4 board before you can get their attention. This is why I think it would be better if the emails come from the site itself. If people got notifications about updates from the site itself they would feel much more of an urgency to update the site because it is more of a personal tie to the site. And for those who build and maintain a lot of sites like we do, I would want to have to try to remember to go log the URL in Google every time for the updates notifications.
Also another PRO to this is that if the site itself notified ALL super users that an update is available, then you would have a much larger chance of the site getting updated when multiple persons are notified.
Just my thoughts to ponder.
Regards, Mike Carson Integrated Technology & Design Inc. Your Web Solutions Partner http://itdwebdesign.com 1-888-760-0878
The information contained in this e-mail message, and any attachment, is confidential and may not be disclosed without our express permission. If you are not the intended recipient or agent responsible for delivering this message to the intended recipient, you are hereby notified that you have received this message in error and that any review, dissemination, distribution, forwarding or copying of this message, and any attachment, in whole or in part, is strictly prohibited. If you have received this message in error, please immediately notify us by telephone, fax or e-mail and delete the message and all of its attachments. Thank you.
*From:* joomla-dev-cms@googlegroups.com [mailto: joomla-dev-cms@googlegroups.com] *On Behalf Of *Mark Dexter *Sent:* Thursday, February 09, 2012 1:24 PM *To:* joomla-dev-cms@googlegroups.com *Subject:* Re: [jcms] Joomla Version Number and Google Webmaster Tools
@Mike: I agree that email notification would be a good feature to look at for core. I think it could be done with a CLI application running from a cron job. However, I don't think that would be a reason not to implement the proposed Google method as well. The more ways we have to let people know about updates, the better in my opinion.
@Ken: With the present update check, we only check the site once per day.
As far as doing this with a plugin, we could certainly do that but it seems like a lot of code and fuss for such a small thing.
Mark
On Thu, Feb 9, 2012 at 11:22 AM, Mike Carson <m...@itdwebdesign.com> wrote:
I’m sure there are pros and cons about how you do this in any manner.
The site has to do a call home to somewhere to check version numbers no matter what way you implement it.
I think it’s worth discussing though. And personally I think that we need to keep security as a number one concern with making it easy to find out the version number of any given site.
Regards, Mike Carson
*From:* joomla-dev-cms@googlegroups.com [mailto: joomla-dev-cms@googlegroups.com] *On Behalf Of *Ken Ballou *Sent:* Thursday, February 09, 2012 1:16 PM
*To:* joomla-dev-cms@googlegroups.com *Subject:* Re: [jcms] Joomla Version Number and Google Webmaster Tools
Wouldn't a busy site hammer the update server hard with requests to check for an updated version?
On 2/9/2012 2:13 PM, Mike Carson wrote:
The more I think about this, I feel there are better ways of achieving the
exact same thing internally on the site itself.
I'm going to use Akeeba Backup as an example. It has a built in update
email notification. So when there is a new version of Akeeba Backup then
the site sends an email to the site administrator notifying then that a
new update is available. This is a very nice feature. Why couldn't the CMS
have an update notification plugin that works in a cronless manner and is
just triggered when the site gets a visit and then sends out the email
-- You received this message because you are subscribed to the Google Groups "Joomla! CMS Development" group. To post to this group, send an email to joomla-dev-cms@googlegroups.com. To unsubscribe from this group, send email to joomla-dev-cms+unsubscribe@googlegroups.com. For more options, visit this group at http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
-- You received this message because you are subscribed to the Google Groups "Joomla! CMS Development" group. To post to this group, send an email to joomla-dev-cms@googlegroups.com. To unsubscribe from this group, send email to joomla-dev-cms+unsubscribe@googlegroups.com. For more options, visit this group at http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
-- You received this message because you are subscribed to the Google Groups "Joomla! CMS Development" group. To post to this group, send an email to joomla-dev-cms@googlegroups.com. To unsubscribe from this group, send email to joomla-dev-cms+unsubscribe@googlegroups.com. For more options, visit this group at http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
A plugin disabled by default sounds good. One question that comes to mind .... If it is agreed to then would that add weight to Joomla sites in searches because Google favours software that acknowledges them ?
On Thursday, 9 February 2012 19:27:01 UTC, Hannes Papenberg wrote:
> I'm not talking about a plugin to hide it, but to remove that completely > from the core (I think its in JDocumentHTML) and instead add the tag with > that plugin. So if you want to hide the generator tag, you simply disable > that plugin, instead of adding a new plugin. The version number would just > be a fixed part of that tag.
> Am 09.02.2012 20:04 schrieb "Rouven Weßling" <m...@rouvenwessling.de>:
>> I'm also in favor.
>> I do find it amusing that we just went trough quite a bit of trouble with >> 2.5.0 and 2.5.1 to hide the version number for unauthorised vistors.
>> On 09.02.2012, at 19:55, Hannes Papenberg wrote:
>> > Like it. Maybe the best way would be to add a global parameter that
>> > adds/removes the whole generator tag. Or go a step further and make it a
>> > super simply plugin that you can enable/disable. Enabled by default.
>> There are already extensions out there that allow you to hide the >> generator tag, I don't see why we have to suck it into the core.
>> Rouven
>> --
>> You received this message because you are subscribed to the Google Groups >> "Joomla! CMS Development" group.
>> To post to this group, send an email to joomla-dev-cms@googlegroups.com.
>> To unsubscribe from this group, send email to >> joomla-dev-cms+unsubscribe@googlegroups.com.
>> For more options, visit this group at >> http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
I very much doubt that. I don't think this has anything to do with page rank (other than indirectly that Webmaster Tools gives you tips for improving your site). Mark
On Thu, Feb 9, 2012 at 4:11 PM, Webdongle <i...@weblinksonline.co.uk> wrote: > A plugin disabled by default sounds good. One question that comes to mind > .... If it is agreed to then would that add weight to Joomla sites in > searches because Google favours software that acknowledges them ?
> On Thursday, 9 February 2012 19:27:01 UTC, Hannes Papenberg wrote:
>> I'm not talking about a plugin to hide it, but to remove that completely >> from the core (I think its in JDocumentHTML) and instead add the tag with >> that plugin. So if you want to hide the generator tag, you simply disable >> that plugin, instead of adding a new plugin. The version number would just >> be a fixed part of that tag. >> Am 09.02.2012 20:04 schrieb "Rouven Weßling" <m...@rouvenwessling.de>:
>>> I'm also in favor.
>>> I do find it amusing that we just went trough quite a bit of trouble >>> with 2.5.0 and 2.5.1 to hide the version number for unauthorised vistors.
>>> On 09.02.2012, at 19:55, Hannes Papenberg wrote:
>>> > Like it. Maybe the best way would be to add a global parameter that >>> > adds/removes the whole generator tag. Or go a step further and make it >>> a >>> > super simply plugin that you can enable/disable. Enabled by default.
>>> There are already extensions out there that allow you to hide the >>> generator tag, I don't see why we have to suck it into the core.
>>> Rouven
>>> -- >>> You received this message because you are subscribed to the Google >>> Groups "Joomla! CMS Development" group. >>> To post to this group, send an email to joomla-dev-cms@googlegroups.** >>> com <joomla-dev-cms@googlegroups.com>. >>> To unsubscribe from this group, send email to >>> joomla-dev-cms+unsubscribe@**googlegroups.com<joomla-dev-cms%2Bunsubscribe@ googlegroups.com> >>> . >>> For more options, visit this group at http://groups.google.com/** >>> group/joomla-dev-cms?hl=en-GB<http://groups.google.com/group/joomla-dev-cms?hl=en-GB> >>> .
> To post to this group, send an email to joomla-dev-cms@googlegroups.com. > To unsubscribe from this group, send email to > joomla-dev-cms+unsubscribe@googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
I really like the idea, but only if there IS A PARAMETER for at least the first version. I don't mind if the default is on or off, but if some security hole is discovered, you really want site admins to be able to turn it off, although I agree that the benefits far outweigh the risks.
> 1. WordPress by default puts the full version number in the metadata, > similar to what we do ( > <meta name="generator" content="Joomla! 1.5 - Open Source Content > Management" />) except with the full version (for example 1.5.23). > 2. WordPress notifies Google when a new version is released or when an > old version reaches end of life. > 3. When the Google crawler finds a site that should be updated and is > registered in Webmaster Tools, Google sends a message via Webmaster > Tools to the site admin notifying them that the site should be > updated. (If the site is not registered with Webmaster Tools, nothing > happens.)
> One important advantage of this approach is that site admins can have > their Webmaster Tools messages forwarded to them via email. So they > can be notified about updates without having to visit or log in to the > sites.
> The only change we would need to do to enable this would be to put the > full version in a meta element. Some people have expressed concern > that this is a security risk. Google and WordPress (and most security > people I've talked to) think the benefits of update notification are > far greater than any risk. (Evidently most hackers just try to run an > exploit and don't bother checking for software versions. Also the full > version number is already exposed in the > administrator/manifests/files/joomla.xml file.)
> The PLT thinks it would be a good thing to do. If enough people are > concerned about it, we could add a global configuration parameter that > would allow people to not expose the version. Even without a > parameter, anyone could write a simple plugin to alter or remove the > metadata.
> My first choice would be to simply add the version number in the > metadata without another parameter. My second choice would be to add > it in with a parameter (with a default value of showing the version > number).
> What do other people think about this? Thanks.
> Mark Dexter > -- > You received this message because you are subscribed to the Google > Groups "Joomla! CMS Development" group. > To post to this group, send an email to joomla-dev-cms@googlegroups.com. > To unsubscribe from this group, send email to > joomla-dev-cms+unsubscribe@googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
To be honest sniffing for the version is one of those nice to haves but if someone is really after your site they'll just open up with a broad base of attacks that might stick to see what is vulnerable and work from there. In a sense publicly disclosing the version number is an issue but in a much more real sense hiding it isn't going to stop someone just probing the site and hitting exploit points anyway.
If anything all they really care about is if it is Joomla! or not so they can pick their attack toolkit. From there running through every vuln from 1.0 to now really isn't a problem for your average script kiddie, just a matter of time.
On Thu, Feb 9, 2012 at 5:39 PM, Brad Gies <rbg...@gmail.com> wrote:
> +1
> I really like the idea, but only if there IS A PARAMETER for at least the > first version. I don't mind if the default is on or off, but if some > security hole is discovered, you really want site admins to be able to turn > it off, although I agree that the benefits far outweigh the risks.
>> 1. WordPress by default puts the full version number in the metadata, >> similar to what we do ( >> <meta name="generator" content="Joomla! 1.5 - Open Source Content >> Management" />) except with the full version (for example 1.5.23). >> 2. WordPress notifies Google when a new version is released or when an old >> version reaches end of life. >> 3. When the Google crawler finds a site that should be updated and is >> registered in Webmaster Tools, Google sends a message via Webmaster Tools to >> the site admin notifying them that the site should be updated. (If the site >> is not registered with Webmaster Tools, nothing happens.)
>> One important advantage of this approach is that site admins can have >> their Webmaster Tools messages forwarded to them via email. So they can be >> notified about updates without having to visit or log in to the sites.
>> The only change we would need to do to enable this would be to put the >> full version in a meta element. Some people have expressed concern that this >> is a security risk. Google and WordPress (and most security people I've >> talked to) think the benefits of update notification are far greater than >> any risk. (Evidently most hackers just try to run an exploit and don't >> bother checking for software versions. Also the full version number is >> already exposed in the administrator/manifests/files/joomla.xml file.)
>> The PLT thinks it would be a good thing to do. If enough people are >> concerned about it, we could add a global configuration parameter that would >> allow people to not expose the version. Even without a parameter, anyone >> could write a simple plugin to alter or remove the metadata.
>> My first choice would be to simply add the version number in the metadata >> without another parameter. My second choice would be to add it in with a >> parameter (with a default value of showing the version number).
>> What do other people think about this? Thanks.
>> Mark Dexter >> -- >> You received this message because you are subscribed to the Google Groups >> "Joomla! CMS Development" group. >> To post to this group, send an email to joomla-dev-cms@googlegroups.com. >> To unsubscribe from this group, send email to >> joomla-dev-cms+unsubscribe@googlegroups.com. >> For more options, visit this group at >> http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
> -- > You received this message because you are subscribed to the Google Groups > "Joomla! CMS Development" group. > To post to this group, send an email to joomla-dev-cms@googlegroups.com. > To unsubscribe from this group, send email to > joomla-dev-cms+unsubscribe@googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/joomla-dev-cms?hl=en-GB.
I like the idea and think it would be very useful to a ton of users,
and more notification is better.
My only feedback is that I think a parameter is the best idea. Adding
it as a plugin doesn't really have any benefit and moving everything
to system plugins is slowly becoming overwhelming. This would be
implemented with a simple/fast "if ($config->get('show;)) $doc-
>addCustomTag('blah');". With a system plugin, with every page load,
you're adding extra CPU time and memory overhead for construction,
adding to the array of plugins, the execution for this plugin for each
onAfter event, etc.
Eventually, all the system plugins do add up, and it's also getting
hard to manage all the disparate System plugins which do different
things. Since there's no grouping, this will get lost and frankly be
harder to find than necessary.
In short, this seems like a perfect setting for the "Site" global
config area and not as a plugin :)
Given that it's really simple to infer the version anyway, I'd opt for a really simple solution. Change the default generator to include the version and add a parameter to the core templates to change it or turn it off (which would save people asking how to do it), and template designers can follow suit (if they don't already).
On Friday, 10 February 2012 14:36:16 UTC+10, Samuel Moffatt wrote:
> To be honest sniffing for the version is one of those nice to haves > but if someone is really after your site they'll just open up with a > broad base of attacks that might stick to see what is vulnerable and > work from there. In a sense publicly disclosing the version number is > an issue but in a much more real sense hiding it isn't going to stop > someone just probing the site and hitting exploit points anyway.
> If anything all they really care about is if it is Joomla! or not so > they can pick their attack toolkit. From there running through every > vuln from 1.0 to now really isn't a problem for your average script > kiddie, just a matter of time.
> Given that it's really simple to infer the version anyway, I'd opt for a
> really simple solution. Change the default generator to include the
> version and add a parameter to the core templates to change it or turn it
> off (which would save people asking how to do it), and template designers
> can follow suit (if they don't already).
> Regards,
> Andrew Eddie
> On Friday, 10 February 2012 14:36:16 UTC+10, Samuel Moffatt wrote:
> > To be honest sniffing for the version is one of those nice to haves
> > but if someone is really after your site they'll just open up with a
> > broad base of attacks that might stick to see what is vulnerable and
> > work from there. In a sense publicly disclosing the version number is
> > an issue but in a much more real sense hiding it isn't going to stop
> > someone just probing the site and hitting exploit points anyway.
> > If anything all they really care about is if it is Joomla! or not so
> > they can pick their attack toolkit. From there running through every
> > vuln from 1.0 to now really isn't a problem for your average script
> > kiddie, just a matter of time.
