Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:105613
MIME-Version: 1.0
References: <CAF+90c-4-R4SYY_AAL679ZYBn2QAZTYAGXH6E6Bz1hYGN=MFcA@mail.gmail.com>
 <CAOwTYAv_kmgqoLvqqsp04ajh0RyPTxqGg3z_zBTx6hX_ydTxrw@mail.gmail.com>
 <CAOkcCt_jEbzwX3ukj1dreL910Effz-vBo8YJGQ5iN=5tkvFJCg@mail.gmail.com> <CAJHtznwQf_tv_0TNKPMeQQ2nXrB6WgDCY6jS1y16Oafvk7SkTQ@mail.gmail.com>
In-Reply-To: <CAJHtznwQf_tv_0TNKPMeQQ2nXrB6WgDCY6jS1y16Oafvk7SkTQ@mail.gmail.com>
Date: Tue, 7 May 2019 12:28:41 +0100
Message-ID: <CALKiJKpQ69Ai_1ZbGpKeYinDmkontviMktotPZUaN=mWb1Abrw@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000007cfb1605884a856a"
Subject: Re: [PHP-DEV] open_basedir?
From: rowan.collins@gmail.com (Rowan Collins)

--0000000000007cfb1605884a856a
Content-Type: text/plain; charset="UTF-8"

On Tue, 7 May 2019 at 11:38, Zeev Suraski <zeev@php.net> wrote:

> - especially here, where folks who rely on it for (even some level of)
> security would have a lot of work on their hands to come up with a
> different solution for isolation.
>


This point is worth dwelling on I think: if someone is using this feature
as part of their security right now, is it better than nothing?

I don't think it's sensible to assume that everyone seeing the deprecation
notice will immediately put into place a security review of their hosting,
so we should consider which of the following will lead to the best security
outcome:

a) open_basedir remains available, and people keep using it
b) open_basedir is removed in PHP 8, and people upgrade without reviewing
the rest of their security
c) open_basedir is removed in PHP 8, and people stay on PHP 7.4 instead of
upgrading

If scenario (a) gives even a slight security advantage over scenario (b),
we should think very carefully before removing the feature.

Regards,
-- 
Rowan Collins
[IMSoP]

--0000000000007cfb1605884a856a--