BLUG Wiki

User Tools

Site Tools

You are here: start » projects » todo
Trace:
projects:todo

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
projects:todo [2026/09/23 15:17] – [PHP] BLUG Adminprojects:todo [2026/10/14 21:46] (current) – ToDo checked: WordPress's MySQL user should have reduced privileges, not a "allow everything for this database". BLUG Admin
Line 11: Line 11:
 ==== DNS ==== ==== DNS ====
  
 +  * <todo #shenmedouxing:2026-09-27>Delete invalid "zombie" SSHFS and DANE records from DNS (difficult, can't be deleted due to a DNS panel bug, the only solution is to rollback to the fresh AXFR and readd all DNS records.</todo>
   * <todo>Publish SSH fingerprints via DNS.</todo>   * <todo>Publish SSH fingerprints via DNS.</todo>
-  * <todo>Enable CAA with pinned Let's Encrypt account key.</todo>+  * <todo #shenmedouxing:2026-09-26>Enable CAA with pinned Let's Encrypt account key.</todo>
   * <todo>Publish HTTPS certificate fingerprints via DNS, implement secure automatic updates (difficult).</todo>   * <todo>Publish HTTPS certificate fingerprints via DNS, implement secure automatic updates (difficult).</todo>
   * <todo>Publish XMPP certificate fingerprints via DNS, implement secure automatic updates (difficult).</todo>   * <todo>Publish XMPP certificate fingerprints via DNS, implement secure automatic updates (difficult).</todo>
-  * <todo>Advertise Alt-Svc support for HTTP/2 and HTTP/3.</todo>+  * <todo #shenmedouxing:2026-09-27>Advertise Alt-Svc support for HTTP/2 and HTTP/3.</todo>
  
 ==== TCP ==== ==== TCP ====
Line 32: Line 33:
 ==== PHP ==== ==== PHP ====
  
-  * <todo>Completely reinstall WordPress.</todo> +  * <todo #shenmedouxing:2026-10-14>Completely reinstall WordPress as a Trojan precaution.</todo> 
-  * <todo>Run WordPress with read-only <todo>/var/www</todo> (<code>wordpress:www-data</code> with mode 650), with out-of-band auto upgrade via <code>wp-cli</code>. This simulate W^X with Unix permissions to harden WordPress from PHP Trojans.</todo>.+  * <todo #shenmedouxing:2026-10-14>Run WordPress with read-only</todo> ''/var/www'' (''wordpress:www-data'' with mode ''750'' and ''640''), with out-of-band auto upgrade via ''wp-cli''via cron. This simulates ''W^X'' at the PHP level with Unix permissions to harden WordPress from PHP Trojans. 
 +  * <todo>Separate the webroot and PHP basepath of WordPress and DokuWiki, with no symlinks between them.</todo> 
 +  * <todo #shenmedouxing:2026-09-26>WordPress should use a Unix domain socket to talk MariaDB, disable TCP/IP on MariaDB.</todo> 
 +  * <todo #shenmedouxing:2026-10-14>WordPress's MySQL user should have reduced privileges, not a "allow everything for this database".</todo>  
   * <todo>WordPress and DokuWiki accounts should have password resets.</todo>   * <todo>WordPress and DokuWiki accounts should have password resets.</todo>
   * <todo>Inactive historical accounts should be disabled or deleted.</todo>   * <todo>Inactive historical accounts should be disabled or deleted.</todo>
Line 61: Line 65:
   * <todo>XEP compliance tests</todo>   * <todo>XEP compliance tests</todo>
   * <todo #shenmedouxing:2026-09-22>Implement XMPP over HTTP (BOSH), commit changes to Git.</todo>   * <todo #shenmedouxing:2026-09-22>Implement XMPP over HTTP (BOSH), commit changes to Git.</todo>
-  * <todo>Implement XMPP over Websocket, commit changes to Git.</todo>+  * <todo #shenmedouxing:2026-09-23>Implement XMPP over Websocket, commit changes to Git.</todo>
   * <todo><code>ircbindxmpp</code> and <code>chatlist</code> should be retested for startup timing and crash recovery</todo>   * <todo><code>ircbindxmpp</code> and <code>chatlist</code> should be retested for startup timing and crash recovery</todo>
   * <todo><code>ircbindxmpp</code> should use SASL External, with automatic certificate generation on first startup.</todo>   * <todo><code>ircbindxmpp</code> should use SASL External, with automatic certificate generation on first startup.</todo>
projects/todo.1790176620.txt.gz · Last modified: (external edit)

Page Tools

Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
CC Attribution-Share Alike 4.0 International Donate Driven by DokuWiki Template From SyntaxSeed