feature request: integrate Params backup plugin

[johanpeters]

create a integration with Params Backup plugin so you can use panopticon to backup / restore params backup to or from sites.

[nikosdion]

I'm afraid I cannot do that. I cannot spend my unpaid time promoting someone else's work competing with the software I need to sell to make a living and feed my family.

[johanpeters]

Hello Nicholas, where do you see any competing.. params backup does only one thing.. backup / restore params from components, modules and plugins. so its not competing with for example Akeeba Backup. its more a add on so small changes in settings can be saved / restored and not a complete restore of the site. but i understand that you need your time and money.. no arguh with that.

…

On Tue, 17 Sept 2024 at 10:58, Nicholas K. Dionysopoulos < ***@***.***> wrote: I'm afraid I cannot do that. I cannot spend my unpaid time promoting someone else's work competing with the software I need to sell to make a living and feed my family. — Reply to this email directly, view it on GitHub <#812 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAKYSGSWYUZNWBRWYTKM7EDZW7VLFAVCNFSM6AAAAABOKXASBOVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANRWHAYTSMY> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[nikosdion]

The typical use case of protecting yourself a bad change in parameters is easily addressed in Akeeba Backup with an "All configured databases" type backup profile where all tables are excluded except #__extensions and #__modules.

Moreover, I don't like at all that the component you asked me to integrate saves the “backups” it creates as unencrypted JSON files in a well-known location inside the component's folder. Many extensions include secrets in their configuration. Putting these into files makes it far easier for an attacker.

Even worse, it makes encrypted data accessible to attackers! For example, our encrypted settings in Akeeba Backup are secure on the fact that the encrypted data is stored in database while the encryption key is stored as a file. This would require an attacker to be able to read both files and database contents to decrypt them, at which point they have thoroughly infiltrated your site anyway. If you use this component to dump Akeeba Backup's settings into a file you now have both the encrypted data and the encryption key stored as files, which reduces the attacker's job to a file read vulnerability, a significantly lower barrier to attack.

So, even if I had the time and lack of self preservation to spend my time promoting a competing product I would still not be able to do it in good conscience given the obvious security flaw of this approach.

Note that if the component was NOT storing the “backups” as local files, instead letting you download them to your computer, I would have no objection to its security model. The difference in this case would be that the settings backup is on a different computer than the actual site. If someone has hacked you so thoroughly, well, I would say that they wouldn't need to look into your extension settings to wreak havoc upon you.