This week’s PHP vulnerability is a timely reminder of how much of our music-making depends on servers, licences and software. Here's few simple habits that help.
This week’s PHP vulnerability kept web administrators busy around the world. Two critical flaws were found in PHP, the programming language behind roughly 70 per cent of websites whose server language can be identified, and patches were released on 21 October. Every WordPress site runs on PHP, so plenty of band websites, merch stores, label pages and music retailers will need the update, which gets applied to the server itself rather than through WordPress.
Read up on all the latest features and columns here.
Most musicians will never touch a line of PHP, but plenty of what we use to make and sell music relies on servers, software updates and the businesses behind them. Almost all of the time, that works smoothly. It’s still worth knowing where those dependencies are.
Plugged in and switched on
Twenty years ago, a studio was mostly physical. A desk, a tape machine or an early DAW, a rack of outboard and the instruments in the room. If it was plugged in and switched on, it worked, and if something broke, a tech could open it up and fix it.
The modern setup is far more capable and far more affordable, and it comes with a few dependencies most of us rarely think about. Plugins check in with licence servers. DAWs need authorising. Interfaces need drivers that keep up with each new operating system. Synths, modellers and pedals increasingly use editor apps, firmware updates and cloud preset libraries. And once the music is finished, it lives on platforms we don’t own.
Day to day, modern gear is as dependable as ever. The things worth keeping an eye on have simply moved from the patch bay to places most players and producers don’t often look.
Licences and the cloud
Copy protection has been part of music software for decades, and it protects the developers who make the tools we use. For the most part it does its job without anyone noticing. Now and then, though, a problem elsewhere on the internet can have a knock-on effect.
In June 2019, network congestion at Google disrupted some cloud-based plugin licences for a few hours, and a number of users couldn’t open sessions until service was restored. Nobody had done anything wrong on their end.
Licensing models also change over time as the industry moves between subscriptions and perpetual licences. Users have been vocal about what they want, and developers have often adjusted in response. It’s still handy to know what kind of licence each of your plugins uses and what happens to it if you stop paying.
Steinberg, for example, has been moving Cubase and Nuendo users from the USB-eLicenser dongle to a new licensing system that does away with the hardware key. It’s a sensible step, and anyone opening an old project on an old version will want to know where their licences live.
Software also changes hands from time to time. Over the years, several well-known DAWs and plugin lines have been picked up by new owners, usually with users carrying on as before.
Keeping up with updates
Operating system updates can take some managing too. When Apple released macOS Catalina in 2019, it ended support for 32-bit software, and older plugins and apps that hadn’t been updated no longer opened. Apple’s move to its own silicon chips a year later had producers checking compatibility charts before upgrading, while developers worked through updates for their products.
Older hardware can be affected in a similar way. An audio interface can be in perfect working order but need updated drivers to run on the latest version of macOS or Windows. Plenty of engineers have a piece or two of older gear they keep a spare computer around for.
App-based instruments work on the same principle. A modeller or synth that uses an editor app for deeper tweaking works best with that app kept current. It’s one reason a lot of players enjoy gear with every control on the front panel, and why it’s worth keeping firmware and editor installers backed up.
Where the music lives
Finished music has its own history here. In 2019, Myspace revealed that a server migration had lost music uploaded between 2003 and 2015, an estimated 50 million songs. Plenty of bands from that era had used it as their main home online.
Streaming and download platforms have grown a lot since then, and many have changed ownership along the way. For artists, it’s a good reason to keep their own copies of everything and give fans more than one place to find them.
Closer to home, if your band site or merch store runs on WordPress, it’s worth knowing who looks after the server underneath it and whether PHP has been updated. The same goes for anyone streaming their own catalogue or sample library from a self-hosted media server, as many of the popular open-source options, such as Koel, are built on PHP too. For a lot of artists, the honest answer is a mate who set it up a few years ago and hasn’t logged in since.
Staying in control
There’s no need to ditch the laptop and go back to tape. Modern tools are brilliant, and most of the time they work exactly as they should, but these habits will save you a headache down the track.
Print your stems. Bouncing each track of an important session to audio, with effects, means you can open it in any DAW years from now, regardless of which plugins you still have installed.
Keep your installers and licences. Store offline installers and licence files somewhere safe, and know which of your plugins need an internet connection to authorise.
Time your upgrades. Hold off on operating system updates until a project is finished, and check your DAW, plugin and driver compatibility before you take the plunge.
Back up twice. Keep masters and session files in at least two places, and make sure one of them isn’t connected to the internet.
Know who runs your website. Find out who hosts your site and who is responsible for updating it. If the answer is nobody, a managed platform might be less hassle.
Have an offline plan for gigs. Make sure your live rig works with the wifi switched off, and keep backup presets on the device itself.
This week’s PHP vulnerability is a good reminder to put some of that into practice. If your band site, merch store or label page runs on WordPress, check with your host or whoever manages the server that PHP has been updated to one of the patched versions. While you’re at it, make sure your plugins and themes are up to date and you have a recent backup of the site. It’s a ten-minute job for most people, and it’s the same kind of housekeeping that keeps your sessions, plugins and music safe in the studio.
Read up on all the latest features and columns here.
