Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:105674
To: internals@lists.php.net
References: <CAF+90c-4-R4SYY_AAL679ZYBn2QAZTYAGXH6E6Bz1hYGN=MFcA@mail.gmail.com>
 <ea139574152ce7376946c8e2d45051df@bohwaz.net>
 <CANUQDCjV3ke8jFmeBEXOzEi5HLQiYwWmC2UUaoOP+t0JGRtg9Q@mail.gmail.com>
 <20190511021217.1aaac8f5@platypus>
 <CANUQDChJJhhnqkDjmK792U63BViZY3aRpyzKtJjQffBggPmo6w@mail.gmail.com>
Message-ID: <3cc47019-c446-141c-0c96-4d5d1545230c@lsces.uk>
Date: Sat, 11 May 2019 10:11:58 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.6.1
MIME-Version: 1.0
In-Reply-To: <CANUQDChJJhhnqkDjmK792U63BViZY3aRpyzKtJjQffBggPmo6w@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-GB
Content-Transfer-Encoding: 7bit
X-thewebhostserver-MailScanner-Information: Please contact the ISP for more information
X-thewebhostserver-MailScanner-ID: 1hPO2w-002cuq-SR
X-thewebhostserver-MailScanner: Found to be clean
X-thewebhostserver-MailScanner-SpamCheck: 
X-thewebhostserver-MailScanner-From: lester@lsces.uk
X-Spam-Status: No
X-AuthUser: lester@lsces.uk
Subject: Re: [PHP-DEV] open_basedir?
From: lester@lsces.uk (Lester Caine)

On 11/05/2019 08:53, Niklas Keller wrote:
>>> That's exactly the reason why I'm for removing it. There will always
>>> be ways to circumvent open_basedir and setups like this are insecure.
>>> It gives a false sense of security. It's not better than nothing,
>>> because most hosting providers would opt for a real solution instead
>>> of leaving users entirely unprotected.
>> What's your solution then? I'll be more than happy to have anything
>> better that will work with thousands of users:)
> Solutions that work at the OS level have been suggested in this
> thread. It's not my job figuring out a solution that works better for
> your business at scale.

Suggested, but that falls short of providing a solution for those users 
who may well not even be aware it is being used. When one hits a 
deprecation warning there should be a reasonable set of instruction to 
go with it offering an alternative. It SHOULD also be recognised that 
many users will not actually have any control over the OS level and 
being able to wrap different applications running in ones own shared 
hosting to protect one's own operation IS one of the useful features 
open_basedir provides? Having to create different hosting accounts to 
achieve that seems somewhat insane?

https://uk.godaddy.com/help/can-i-use-open-basedir-on-my-server-running-parallels-plesk-panel-1619 
is an example of one hosting providers use of it and something which 
would probably require every host to rework their support crib sheets :(

-- 
Lester Caine - G8HFL
-----------------------------
Contact - https://lsces.uk/wiki/Contact
L.S.Caine Electronic Services - https://lsces.uk
Model Engineers Digital Workshop - https://medw.co.uk
Rainbow Digital Media - https://rainbowdigitalmedia.co.uk