How about the fact that his Insecure-by-default section contains only items that aren't actually PHP defaults. Or at least hasn't been defaults for a very long time for some of them. register_globals hasn't been enabled by default for 8 years now? 10 maybe? I forget the exact version, but it was a long time ago. "include accepting HTTP URLs" hasn't been the default since at least 5.2 and that was 6 years ago. And magic_quotes are finally gone in 5.4.
Also his grand-finale 5.4 critical bug related to the Content-Length header. He fails to clarify that this is only in the built-in web server which is not intended to be used as a public-facing web server. So yes, it is a silly bug, but not one that is actually all that interesting.
Liquidating domain names? I'm really surprised that the comments here are so supportive of domain name squatting. This is a sleezy business done by sleezy people. Even worse than the SEO garbage we see. If you are not using a domain, give it up and let someone who is able to do something interesting with it use it.
Unfortunately that's not how the Web is anymore. It used to be. I really wish you had to provide a reason for wanting a domain name and then there would be some sort of yearly review to make sure you actually did what you said you were going to do with the domain.
This isn't that out of the ordinary, is it? We all turn down advances like this all the time. The battle for talent is rather heated these days, so being picky and avoiding litigious dick-move companies like Sony doesn't take a whole lot.
Nothing is ever really secure. Yes, non-technical Starbucks users are easy targets, but so are most web sites. The last couple of "Review my startup/app" HN posts have all had very obvious XSS holes, for example, and many others have completely insecure session handling even if they do send them over HTTPS. We all tend to wonder just how lame less technical users are and forget that someone else is probably wondering right now how we, ourselves, can be so lame and not understand basic Web security for our own sites.
Note that the Google Maps API have very similar terms. Most people ignore those terms, of course, but technically you need to pay Google at least $10,000/year to use their Maps API for any sort of commercial project.
The bigger problem is that a svn update isn't atomic, so you are going to be in an inconsistent state for a while. Capistrano with its atomic symlink switch is a much better approach although you have to watch out for caching issues and clear caches appropriately.
seiji, an open ssh port also isn't that big a deal. Every large network has an ssh entry point somewhere. I did a quick check before and at least it only accepted ssh-2. But yes, I agree with you that having that entry point on the main domain is a bad idea, but realistically we are talking about security through obscurity here. With enough guessing you can find the ssh entry point for any large site. The trick is whether you can get through it. They tend to all have 2-factor auth behind them making it extremely hard to bypass. I have no idea whether wepay has 2-factor auth behind theirs though.
https://github.com/github/gitscm-next/issues/45