53 Comments

1. John Coonen makes this comment

   2008-11-07 08:12:05

   Brad,
   
   If you had an audience of 50, you'd need to spend a great deal of effort to get the point across. Now, multiply that audience by 100, 1000 or 10,000. All that brain-numbing repetition starts to feel like government work, doesn't it?
   
   But that's the price you pay when you've got a success on your hands. Ironically, if you all keep doing your jobs right, the parade from the noob-side never ends. And so it goes.
   
   Keep fightin! -JC

2. Tobias Kuhn makes this comment

   2008-11-07 09:07:52

   Well I think the problem is that most people dealing with security issues tend to loose their head. So they all "run" to the security forum and ask for "human" help, rather than reading the stickies.

3. Tobias makes this comment

   2008-11-07 09:13:28

   well, popular companies are always blamed by the community... see Microsoft: they are blamed at least 3 times a day but 90% of PC users still use Microsoft software. So, as long as such people cannot find a better CMS like Joomla (there is none imho) they can blame as long as they want.. I wouldn't matter. I understand that it's annoying to repeat yourself, but if I were you, I would continously keep on helping even such stupid people who aren't able to use the search box... yes, it's crazy, but life isn't always easy

4. Copes Flavio makes this comment

   2008-11-07 10:13:00

   Is this something you think you should have written the Joomla Core Team Blog?
   
   I don't think so.
   
   You could have written this post in the forum, in your personal blog, on the wall outside your house.
   
   But writing this kind of things, blaming the users who make the Joomla project as successful as it is, is not something I'd expect from a Core Team Member.
   
   Perhaps you should write something, go to sleep, wake up next morning and re-read what you wrote.
   
   Does anyone agree with me?

5. Roger aka unixboymd makes this comment

   2008-11-07 10:42:50

   I blame Joomla! for everything... my sites being hacked, the bad server security at my cheap a$$ hosting company, my horrible security practices, the economy, global warming, the recession in the US, the war in Iraq, etc.
   
   It's all their fault!

6. SpacePyrit makes this comment

   2008-11-07 14:33:44

   I think that closing the security forum would be a bad idea. Then you would have people posting security questions elsewhere (where they shouldn't be).
   
   Keep in mind that many of the users that post in the security forum are new Joomla users. When I first started using Joomla and using the forum, it was confusing. I had never used a forum before then. I had the idea that the forum was there to solve my problems so I really did not have to do anything. I often posted a question, but then did not try to find the answer for myself.
   
   This can be aggravating to advanced users. Users need to realize that Joomla is all about the community. Do your share of the work! People are not paid to answer questions, it is a volunteer staff.
   
   In closing, this problem will always be around, you will always get new users, but sadly many people today lack common sense logic (me included, though I am changing that!). There is really nothing you can do except raise the issue.

7. amit shah makes this comment

   2008-11-07 15:41:36

   There is a saying that goes something like this, "like attracts like", so if you find your readers/users/customers to be STUPID then probably ....
   
   I would suggest perhaps a bit more humility and appreciation for folks who DO something, whether "good or bad" in your opinion to try and help all Joomla users.
   
   Thanks.

8. Khan Kardam makes this comment

   2008-11-07 15:44:49

   Brad,
   Don't ignore the documentation site of Joomla! is one of the most user unfriendly things ever .

9. Chad Windnagle makes this comment

   2008-11-07 20:23:36

   I hear you Brad! Nice blog post. I have a feeling no matter how much pounding that you guys do on the issue there will always be someone who just doesn't get it, though. Sadly this is the cause and effect of awesome software and users who don't pay attention to security releases!

10. Chad makes this comment

    2008-11-07 22:03:10

    This was informative, I suppose, and certainly needing to be said in general, but maybe you ought to have the drink / calm down before putting up this type of post. Eh Brad?
    
    It would help with a more neutral tone. That's all.

11. Zello makes this comment

    2008-11-08 06:26:48

    No, don't shut down the security section of the forum. It's the funniest spot on the entire Internet.

12. Sandijs makes this comment

    2008-11-08 15:58:51

    The problem is in Joomla target auditory - inexperienced novices. Inexperienced programmers. Inexperienced sysadmins, etc. Accent on "inexperienced".
    
    You CAN'T change a world with few articles. You can't make the world more educated even within few generations!
    
    So - THE SOLUTION - is to improve Joomla "runtime" environment to not to function in insecure conditions. This could be a performance bottle neck, if performed on every web server call. But, surely, there are some place where to put it in. Paranoid setup program, and some infrequent paranoid security checks.

13. Sabature makes this comment

    2008-11-08 20:30:36

    MAN...KUDOS TO YOU!!!
    
    I am a novice....I have never ever read a book on programing...never paid any attention to programing language until 6 months ago.
    
    Since then I have created over 1000 Joomla websites...and I have NEVER BEEN HACKED...Because...I READ THE JOOMLA STUFF...So for people who complain..
    
    Let me tell them...READ THE POSTS, FORUMS...They are there for a reason...
    
    The developers of Joomla have brought us an invaluable product. If you use it...USE IT PROPERLY...read up and don't be lazy people.

14. Gerardo Rodríguez makes this comment

    2008-11-08 21:04:37

    My words are with Khan Kardam. User Doc site is very difficult to navigate. It is difficult to find where to start in it.

15. Nick Kotarski makes this comment

    2008-11-08 21:08:04

    I think that much of the problem is naive users.
    
    Joomla makes it possible, indeed easy, for everyone and his dog to create a website.
    
    This is on the one hand greatly liberating but on the other very dangerous. Naive users don't know how to evaluate their security. They don't understand the importance of keeping Joomla and extensions up-to-date. So until they get hacked they don't consider security. And when they do get hacked they panic.
    
    Now because they are naive they don't know how to evaluate the posts on the security forum and as many of the posts are from other naive users they jump to irrational conclusions.
    
    What would be really cool would be if it were possible to notify the admin when Joomla or any extensions need to be updated. Sadly it's probably too hard to do.
    
    Nick

16. Mike makes this comment

    2008-11-09 03:00:25

    I'm brand new to the Joomla world and I am surprised to hear someone in the Core group bash their users like this.
    
    I have a personal philosophy about communication. It is always the responsibility of the 'speaker' to make sure s/he is heard. If your audience is hard of hearing, speak up and if they are deaf, learn sign language if you have to.
    
    It's Joomla's responsibility to make sure security holes in THEIR software are applied ASAP. Spend your energy figuring out how to do this and stop wasting your time complaining that your customers are hard of hearing.
    
    Better yet, Brad, perhaps you need some time away from the support end of things. Not everyone is cut out for this type of work!

17. Doug McCormick makes this comment

    2008-11-09 06:08:28

    That's a little bit snippy for me. If you don't want to deal with users - get a shovel job.
    
    like the man said, "But that's the price you pay when you've got a success on your hands. Ironically, if you all keep doing your jobs right, the parade from the noob-side never ends. And so it goes."

18. brad makes this comment

    2008-11-09 06:36:46

    Mike,
    
    Great point.. I'll remind the JSST to work a bit faster next time. 2 hours and 50 mins is far too slow.
    
    See: http://developer.joomla.org/section-blog/26-coordinator-blog/245-how-joomla-156-came-about.html
    
    BTW I am happy to take flack over this post of mine. I'll learn from it.. but I also perceive there to be serious points that could still be taken on board by people who avail themselves of the free community help that is made available to them.
    
    What I was hoping for though, was more constructive suggestions on how we might be able to help peoples education on this subject further, and perhaps more users like yourselves offering to help in the Security Forum.
    
    Do you want to notify the admin when Joomla is updated? See: http://docs.joomla.org/Security_and_Performance_FAQs#How_can_I_add_the_Joomla.21_Security_Announcements_Feed_to_the_Admin_Control_Panel.3F

19. brad makes this comment

    2008-11-09 06:48:02

    BTW there are plenty of opportunities for many others aside from myself to share information on this subject to the community. If you are a Workgroup member, post a blog yourself? If your feed is listed on Connect, let your voice be heard.

20. marius makes this comment

    2008-11-09 08:23:57

    Yes, users ignore simple instructions and you will have silly posts on the forum that could have been easily solved if the user had read the sticky or searched the forum. This is the unfortunate reality when Joomla is so easy to setup and anybody without much experience can have a go with Joomla.
    
    However, I do not like the arrogant overtones that the core developers blogs have had in recent of times. It is not friendly to call people stupid. Yes venting will make you feel better, but by doing so you will give a negative perception to the Joomla philosophy.
    
    Rather than saying "can't believe how stupid some Joomla user are, they can't even follow instructions", please say something like: "Security is important to us at Joomla and we like to help people keep their Joomla site safe. Here is what you could do to keep your site safe: link"
    
    We are all here to help make the Joomla community a positive place and I feel that you should use some more humility in your blog.
    
    Thanks, Marius

21. Marco makes this comment

    2008-11-09 15:24:53

    Hey Brad,
    
    I guess this post was made in an emotional state. Nevertheless, I understand what you are saying.
    
    Addressing the problem here, is not what you should do. It would be better to come up with a solution. Well, that said. Closing the forum is by far most stupid reaction you can do. As so many people are asking the same questions, it is probably not stupidity on the user side, but somewhere deeper within documentation or navigating the website or something else.
    
    First of all, as I mentioned before in another post. The backend of Joomla should have an option to check if there is an upgrade available. No discussion about that.
    
    Second.... This is not an offense. But the site navigation is crap and could use some work from an interaction designer.
    
    my comment is too long

22. Marco makes this comment

    2008-11-09 15:25:59

    continueing here
    
    Example?
    
    As example, picture a user which is not so technical but managed to install it's Joomla! website. From one day to another there is this "all your base belongs to us" message on his website.
    
    USER: I have been hacked!!!
    ACTION: www.joomla.org
    USER: The first look at the homepage... Ah, on the bottomright is says security.
    ACTION: Click.
    SCREEN: "Security Strike Team"
    USER: Well this doesn't help me. What's next. Oh, documentation on top.
    ACTION: Click.
    USER: Great, a Wiki... Well I have been hacked. So let's search for "hack".
    SCREEN: "hack-section-table-category-blog"
    USER: Yes a page about "hack: section - table, category -blog".
    ACTION: Click
    USER: NO results again.. pfff, I am getting tired of Joomla! Oh, I see there is this forum too. Let's check it.
    ACTION: Click
    USER: WOW, there is even a security topic. Let's click it.
    ACTION: Click
    SCREEN: "Have your site been hacked? READ THIS"...

23. Marco makes this comment

    2008-11-09 15:26:43

    and the rest
    
    USER: GREEEEAAAT, Just what I need.
    ACTION: CLICK!
    USER: HUH? I will not get much sympathy? Why not?? I just need some HELP. What did I do wrong? Let's post.. Oh, before I post I have to read that link, good.
    ACTION: CLICK (again)
    SCREEN: [20080902] - Core - Random Number Generation Flaw
    USER: WTF... What is this, I don't understand.
    ACTION: Close window
    SCREEN: Link to checklist
    USER: Ok, another link to a checklist? I don't need a checklist!! My site has been hacked so long already, and I have been searching this site more than 5 minutes now and have no solution yet.
    ACTION: Let post something "Help my site has been hacked, it says...etc."
    SCREEN: Reply post "You're a n00b, read books, topics, bla".
    USER: Ok, let's try Drupal.....
    
    Now... let's drink!

24. Khan Kardam makes this comment

    2008-11-09 15:36:19

    Brad, you didn't reply on the very hard to use documentation site.
    And why do you use wiki for that? Joomla! is a CMS, if it can not deal with its own documentation it is funny.

25. Mike makes this comment

    2008-11-09 23:23:13

    Brad, you kinda missed my point. It's clearly not the speed with which the code is fixed that's the problem. 2 hours and 50 minutes is fantastic (sarcasm noted and not appreciated) but you are frustrated with how long it takes for full adoption across all servers because the current updating architecture relies on folks like me who have been staring at Joomla code for a grand total of about a week now and certainly haven't a clue how to help you out with security. You can certainly just keep fixing the code but that will never solve you frustrations. Fix the updating architecture so these systems can't stay unpatched for years and then you will be on to something really special.
    
    Earlier posts pointed out that Joomla is marketed to those who have neither the time nor the inclination to learn how to code websites. If we knew how, we wouldn't need Joomla. Don't make your 'customers' feel stupid or eventually you won't have any and then all your troubles will surely be gone as well.

26. Norm Douglas makes this comment

    2008-11-09 23:33:02

    The way I see it, is two fold...
    
    Joomla is for me anyway... and awesome DEVELOPMENT PLATFORM, and an end user CMS.
    
    What is happening is that folks with only M$ Office knowledge, think they can build a website. This CAN be fantastic, however it also exposes them to things that some of us take for granted (security etc)...
    
    Therefore, is Joomla's popularity a good thing? Probably, but perhaps we all need to become better at communicating. I for one will put my hand up and say I get frustrated with low end users, and I need to get better at it.
    
    Well done Brad

27. amy.stephen makes this comment

    2008-11-10 02:02:56

    The fact is our community of end users is growing far more quickly than our community of contributors. Sometimes, after repeating the same information over and over - for five years for some people - can be frustrating. But seeing someone post "Those Joomla! people don't care" can feel pretty hugely discouraging and insulting when you have dedicated yourself to the community for so long.
    
    If you want to help relieve the workload some people carry and you want to talk to someone about what opportunities are available, feel free to contact me (AmyStephen AT community DOT joomla DOT org.
    
    Or, contact Brad - he is, without a doubt, one of the "foundations" of Joomla! and without him, I'm pretty certain we'd be in sorry shape - and very possibly not using Joomla!, at all. We owe him a great deal.

28. unleash.it makes this comment

    2008-11-10 03:25:47

    The thing is Amy, Joomla can do more to encourage contributing. How? Change that wiki post that says “Joomla is and never was a democracy” to Joomla IS a democracy! Then award contributors a piece of the pie by weighing their wishes and ideas. Watch how many get inspired to help. And watch how these new perspectives and talents can shape Joomla into something better.
    
    But the reality is a few people at Joomla make all the decisions based on their perspective. There isn’t any real open debate in the forums, and sometimes well meaning ideas (and offers for contribution) are even met with hostility. Even the white papers were not decided based on popularity of users but on the priorities of the devs.

29. unleash.it makes this comment

    2008-11-10 03:26:33

    Part II
    
    You are intelligent, skilled and able people and you obviously deserve to have the main say in how things are done because you do the most work. But don’t forget that you have a lot of talented, professional users who may have stronger skills in certain areas that you may not. For a big project like Joomla, these skills and viewpoints should be considered closer or equal in value to development. With our help, but absolutely not without…you can keep Joomla at the top.
    
    p.s don't get mad at the beginners. Take a deep breath and challenge yourself (and us) on how to ease the problem. I suggest opening up an ongoing dialog on the subject.

30. amy.stephen makes this comment

    2008-11-10 05:10:38

    That is true, Joomla! is not a democracy. There are a couple of really important, common sense reasons for that.
    
    The first reason is, Joomla! is not a government. It is a technical, geeky, cool, fun project. Freedom and democracy come from governments, not Joomla!.
    
    So, how are decisions made? Mostly, decisions are made by individuals and groups who decide to do something and make it happen.
    
    Judge a free software community on one thing -> Are you able to participate and share your "no strings attached" gift? Anyone who wants to do that and needs help finding a way in - give me a holler. I'll help you get plugged in. So can Brad.

31. brad makes this comment

    2008-11-10 05:56:38

    Interesting sociological experiment this.. a negative post, gets far more reaction and feedback than a positive one.
    
    I'm still listening and trying to learn from this experience. Remember though, I am also like you, just a volunteer. I also assure you, being a Core Team member is far from easy and demands hours and hours of my time EACH DAY.
    
    If anyone has time and wants to make a difference.. please get in touch.. there is always things to do. I challenge you.. jump into that security forum.. see if you can make a difference...

32. unleash.it makes this comment

    2008-11-10 07:04:51

    Positive? But so boring... only kidding! You guys work hard and have my total appreciation, and I think for the most part the others writing here feel the same way. Try not to confuse constructive criticism and the desire for Brad to have an easier/stress free day for a lack of love.
    
    I just had some ideas for ways you might attract more contribution. I mentioned democracy, but I should have mentioned some sort of semi-democracy was more the idea, possibly with voting on some decisions. But you can take my ideas or leave them. Sorry, I will not contribute when I feel it makes no sense. Just not motivated to make a larger mess. I did offer to help with documentation. That offer still stands, but not in the form of the wiki. As several people point out, it is not helpful either to this problem, nor the challenge of learning Joomla for a beginner.

33. Nick Kotarski makes this comment

    2008-11-10 14:14:27

    Marco makes an interesting point: There isn't a link from the front page which goes anywhere useful if you want to find out about security or your site has been hacked.
    
    I don't mean that one can't find out it's just that if one is unfamiliar there are too many clicks.
    
    A page explaining about the Joomla Administrators Security Checklist and what to do to get help would be really useful. There are scripts to check the integrity of a site and one to record system information. These need to be made better known.
    
    Nick

34. Sean makes this comment

    2008-11-10 15:20:05

    Hi Brad. If you need some really BIG buttons pointing to the read me first sticky posts, just let me know. I'd be happy to make some.

35. amy.stephen makes this comment

    2008-11-10 16:39:25

    Nick and Marco and Sean (and anyone else) -
    
    When I click on the Security Center link from Joomla.org the information seems very helpful:
    
    - Security Alerts (please subscribe);
    - Helpful Security "How to's";
    - Instructions to report possible vulnerabilities
    
    Would you be willing to help work together in a Google Doc or on the Wiki to define improvements that might be helpful? In 1.5.8, you'll see the Bug Squad added information to the Administration panel. Hopefully, that will help too. It is good to have many perspectives so I hope you consider contributing in this way.

36. Nick Kotarski makes this comment

    2008-11-10 18:44:22

    Amy,
    
    The links that you highlight are not orientated towards new users.
    I'm game to attempt to write a comprehensive guide for new users.
    
    Nick

37. amy.stephen makes this comment

    2008-11-10 19:42:08

    Excellent, Nick! Now, who wants to join Nick and bring improvements for the community in this area? Even those who are new can help by reviewing the material to see if it makes sense. Please give volunteering some thought. We could use *your* involvement.

38. Norm Douglas makes this comment

    2008-11-10 23:59:39

    Somebody made the comment that Joomla is "Joomla is marketed to those who have neither the time nor the inclination to learn how to code websites. If we knew how, we wouldn't need Joomla."... I personally disagree.
    When I first found Joomla/Mambo, I was looking for a development platform that once I had finished building the site, my clients (content owners), could manage their site (from the front end ONLY) and update the content.
    This was a MASSIVE step forward for me, there was no way I could build such a CMS.
    As I have said many times, from my experience MANY of the so-called issues with Joomla, relate to peoples lack of WEB/HOSTING knowledge... which I'm not blaming them for, nor am I saying they need to learn either, rather they need to understand that Joomla is a DEVELOPMENT platform, and therefore they need more skills than JUST how to install Joomla.
    Cheers

39. RussW makes this comment

    2008-11-11 10:10:55

    OK, I have read all the comments, and I will stand-up and wave an arm in the air.... I am one of those "annoyed", "fed-up", "frustrated" and mostly "bored" people that hang out in the Security Forum and in recent weeks have probably been reasonably rude and obnoxious to some. Why? you might ask? In the past, I feel that I have been reasonably helpfull and useful to some, maybe even "educated" some or helped them have a better day - What a great feeling.! BUT... after months of "Joomla! sux.!", "You guys aren't listening.!", "My site got hacked because of you.!" You know what? I'm getting past, myself and folks I respect, being called "ass**les" by some because they cannot be bothered to put the effort in themselves, but then still expect me to put time in to solve their problem...

40. unleash.it makes this comment

    2008-11-12 05:27:48

    Russ, but I think somehow you and Amy and Brad are not getting the point that some of us are trying to make. The problem here, USABILITY and overwhelm of information, is larger than this one post. For a living I teach graphics and web development, so I get to see all the time, how beginners interact with information. It's my job to think like a beginner and I'm constantly trying to do that when I create designs as well. So besides some obviously bad/selfish attitudes by some posters, I believe you have a usability problem. But suggestions are being made to try and help…not just complaining! An idea for a better security message on the front page was made, and I even made a possible graphic a few weeks back (see Sites/Infrastructure forum). Nick has offered to make a manual, which is a GREAT idea AS LONG AS, #1 it’s well organized and coordinated (the problem with the wiki), #2, it’s easily accessible via the front page of Joomla.

41. unleash.it makes this comment

    2008-11-12 05:30:52

    Nick, I recommend getting in touch w/Chris Davenport on this, because I found out after spending over 40 hours creating a smaller manual, that he is strongly discouraging work outside the wiki. Amy doesn’t mention that, nor any information you may need to make your manual a success in the eyes of Joomla and the users. (But if you get it going, also get in touch with Mark Dexter (dextercowley) who writes a lot for the wiki. We spoke about a manual awhile back).

42. unleash.it makes this comment

    2008-11-12 05:32:21

    Part III. I apologize to everyone that I'm unable to think in sound bytes
    
    I think the main problem here is not finding people to do the work, but a fundamental communication problem between team members coordinating project priorities with non-members, and the willingness to at least discuss outside input in meaningful ways. Personally, I think I’ve tried as much as I can to make a good input, but I just feel like no one’s willing and either ignore…or very oddly…sometimes even get sore about trying to SIMPLY DISCUSS the bigger issues. I’ve been told by a few that I don’t understand open source, but does anyone? I think the jury is still out on exactly what it is...
    
    Peace and happy growing pains everyone

43. amy.stephen makes this comment

    2008-11-12 06:13:52

    Russ - Thank you for your considerable contributions, always. Your pleasant and detailed and helpful responses, extensions, FAQs, advice, and guides have no doubt helped thousands who pass thru J! forums. Noli nothis permittere te terere.
    ~ * ~
    Unleash it - thank you, again, for your comments. Since you have expertise in the area of helping beginners and since you are able to see areas of concern, please consider contributing solutions that address those problems. Your work would be warmly received. If you prefer not working in the Wiki, someone could help transfer your work to that medium. So, don't let the Wiki, or anything else, stop you from contributing.

44. blaziu makes this comment

    2008-11-28 09:18:29

    good, but please give us Nov update

45. ccondrup makes this comment

    2008-12-03 22:53:38

    Hey guys, I just saw this post as somehow all the latest 10 rss posts gets updated (touched) when one is added..
    
    So, I'd just like to mention a nice alternative to suPHP which might help people convince their hosts to upgrade and tighten security on their servers. It's called MPM-ITK and you can check it out at http://mpm-itk.sesse.net
    
    This works on the Apache-level and might just well be the tad bit more familiar for your server operator, enough for him to give it a whirl if he for some reason dislikes suPHP.
    
    On a sidenote: Why not make the security checklist one of the clearly visible testdata content articles (possibly via RSS)? So that when admins install their new Joomla, the first thing they'll read is the security checklist.. (I think the "whats new in 1.5" is getting old, and this is an easy change that could be done without any fuzz)
    
    Thanks for your continued effort!
    Chris

46. mandville makes this comment

    2008-12-26 22:39:53

    you can tell the people who got Joomla for xmas,
    now where that c&p of Brads Idots checklist....

47. Bongo makes this comment

    2009-01-17 21:05:38

    Yep, blame the user for believing the hype, blame the user for thinking.... "Joomla is designed to be easy to install and set up even if you're not an advanced user." is actually true...
    
    And offcourse blame them for thinking this is a reality:
    
    "Since Joomla is so easy to use, as a Web designer or developer, you can quickly build sites for your clients. Then, with a minimal amount of instruction, you can empower your clients to easily manage their own sites themselves."
    
    Now stop writing those ridicoulous self important nerdy crap posts and WARN the bloody noobs before they get to work with your oh so high and mightly bloody CMS.

48. amy.stephen makes this comment

    2009-01-17 21:42:02

    Bongo - We welcome you to join us in developing content that can assist new community members successfully build and use Joomla! Web sites. All we have is that which people have freely shared. You can also become a contributor and, in doing so, make Joomla! a bit better.

49. amy.stephen makes this comment

    2009-01-17 21:48:49

    I always say "Joomla! is easy to use, once you learn how to use it."
    
    For those who want to learn, I recommend spending time with The Absolute Beginner's Guide to Joomla! at http://docs.joomla.org/Beginners
    
    At the top of that page, you will find a Quick Start to Joomla!. A couple of our GHOP High School kids created what I consider to be the *very best* getting started resource, ever, including several books I have read. The Quick Start PDF and video are at the VERY top of the Beginner's page. It takes about 4 hours and is well worth the time as you will learn to build a fully function Joomla! Web site in the process.
    
    Hats off to Kevin Hayne and Michael Casha, Quick Start authors and Joomla! contributors, extraordinaire.

50. Kevin Monk makes this comment

    2009-01-19 11:48:15

    Brad! I want to make you feel better. The reason that the security forum is covered in naive questions about hacks is that the people who read the Security guidelines don't post!
    
    I'm a Web designer who's recently created a site for a client that's been recently hacked. I'm going to gloat here and say. I never posted my hack on the forums. I went straight through the checklist. Client's hosting is running PHP4! and offers the new shiny Joomla 1.0.14
    
    The support ticket for PHP update has been submitted to the hosting company. THe system works so dont lose heart. The work of the support team doesn't go unappreciated. There's just a silent mass of people who you never know you helped.

51. march hare makes this comment

    2009-02-16 10:48:31

    I am delighted to say that I found the security wiki before suffering any hack or anything else like it, and consider myself lucky. I always update to the latest as soon as I know about an update, but there is so much more to do, all of which is intensly satisfying. Prevension being better than cure. Very very useful stuff, very well written... I felt much more comfortable about the sites that I run using joomla. It is a pleasure to be able to say to an end user that their site is as secure as reasonably possible without making it an intranet LoL. Thanks Brad, keep on plugging away, no one can say that they were not told.

52. Helen makes this comment

    2009-03-04 18:07:42

    1) Modify the security section of the forum so anyone posting there is forced to show joomla version and all other relevant stuff in with their posting.
    
    2) Tidy up the stickies and links that point to the 'security check lists' and the 'check list' itself as it's very messy, mixed up, all over the place and often not relevant depending on your Joomla version.
    
    These two steps will make it much simpler and more people will follow the check lists and stop asking stupid questions.

53. Jean makes this comment

    2009-09-28 15:12:39

    Having been hacked, I am reading the security pages that you so nicely point out... so as to see what I forgot to do. But... on the first page I read, I can see that the example of rules for .htaccess file you are giving are not complete. There is a series of RewriteCond but no RewriteRule at the end of the list, which is useless:
    http://docs.joomla.org/Htaccess_examples_(security)
    I would suggest a little more explanations in that page...