Ho Ho Ho IntraWeb in Lazarus!!!

[Alex.Machado]

Ho Ho Ho Free Pascal developers!!!!

After a long refactoring, I'm here to announce:

IntraWeb for Lazarus is a few days away!

The same kind of projects and applications that you can build today with IntraWeb, using Delphi, you will be able to do using Lazarus. Same features, same codebase, the same power and performance.

I've been working on the compatibility issues and code base conversion for a long time. The more I worked with Lazarus, the more I liked it (I'll be honest with you I didn't like it much at first). But after you learn some shortcuts and some workarounds - especially when coming from Delphi, it is really pleasant to work with.

FPC developers did a remarkable job. So did the guys that wrote the LCL classes. There are things to improve, yes definitely, but I feel confident that FPC/Lazarus is more than capable to support complex Web applications built with IntraWeb.

I'll keep you all informed.

Cheers and Merry Christmas to all Pascal developers (and the poor guys who work with other languages too) !

[Okoba]

Great news, I am waiting for it.
Happy new year to you too.

[kapibara]

Very Interesting! And Merry Christmas.

[Selzig]

Hello,
this is indeed very interesting. I'll install the package as soon as it's released.
Happy new year to you. Regards. Slz.

[grl]

Hi @all,

Any news on that?
Intraweb could be interesting for new project - so I'd really be interested in the current status of the Lazarus port :-)

Regards
Lukas

[Thaddy]

Intraweb is really easy to hack so bring it on!

[grl]

Another 2 Months - so bumping it up again.

Any news on that project?

regards
Lukas

[marcov]

If I search for OP's name, I get to the Intraweb site, so it seems he is involved with Intraweb. Maybe inquire there?

[wfbhappy]

time

[irawan]

any news on this special product?

[Thaddy]

It is not special, just old... You don't need it.

[VisualLab]

It is not special, just old... You don't need it.

Is it no longer suitable for anything? I'm asking because I once (in Delphi) used this library for my own needs.

[Thaddy]

Yes, I was a bit too harsh. It is still very suitable for Intra!-web appcications, but it is not very suitable for internet applications because of its inherent vulnerabilities that nobody has fixed yet.
So: it is a welcome port, but don't use it outside of a local network.

The latter can of course be mitigated by using a more modern front-end.
I also used it a lot in the past, but I also hacked it - legally, CEH - a lot in the past..
CVE-2017-17527
CVE-2007-0533

to name a few.
It is also very easy to force access violations at runtime in its codebase.
Which is basically also a means of getting control.
I won't get into much further detail, but a web application using Intraweb can be hacked in minutes, not months or years, and it is quite easy to detect if a web application has been written with Intraweb.

[Thaddy]

and <sigh> since my reports are not fixed properly since 2007, I would not use it.
Just google on the CVE's
What is more worrying is that NIST still has not approved a supposed fix from my - our - report in 2007. They are still waiting for it.....
AtoZ is responsible for a fix, not me, we simply reported it in mintute detail.
Both the issues I was involved in are NOT fixed..

[Alex.Machado]

Yes, I was a bit too harsh. It is still very suitable for Intra!-web appcications, but it is not very suitable for internet applications because of its inherent vulnerabilities that nobody has fixed yet.
So: it is a welcome port, but don't use it outside of a local network.

The latter can of course be mitigated by using a more modern front-end.
I also used it a lot in the past, but I also hacked it - legally, CEH - a lot in the past..
CVE-2017-17527
CVE-2007-0533

to name a few.
It is also very easy to force access violations at runtime in its codebase.
Which is basically also a means of getting control.
I won't get into much further detail, but a web application using Intraweb can be hacked in minutes, not months or years, and it is quite easy to detect if a web application has been written with Intraweb.

Hi Thaddy,

Your comments are interesting.

CVE-2007-0533 is precisely 18 years old. It's just like complaining to Microsoft about a bug not fixed in Windows XP.

I doubt that this applies to any recent IntraWeb version. First, because it shares almost no code with that old version. Second, because there is no OnBeforeDispatch processing in IntraWeb. There is an event that you can of course add anything including code that won't work or will crash the server (Just like I can do in any other language and framework).

CVE-2017-17527 is not related to IntraWeb, but to PasDoc which I have never used myself and I'm positive that has no relationship with IntraWeb or any Atozed product.

Recent versions of PHP, released less than 2 years ago (not 18 years), are much more vulnerable to attacks (and much more harmful than just a DoS).

We have IntraWeb customers around the world with applications that are constantly tested and submitted to independent auditing and they show a completely different scenario that the one that you are painting here.

Anyway, I'm open if you want to discuss this further. You can reach me at: alexandre at atozed dot com

Cheers,