Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:106450
Return-Path: <bishop.bettini@gmail.com>
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 99754 invoked from network); 8 Aug 2019 20:42:59 -0000
Received: from unknown (HELO mail-qk1-f173.google.com) (209.85.222.173)
  by pb1.pair.com with SMTP; 8 Aug 2019 20:42:59 -0000
Received: by mail-qk1-f173.google.com with SMTP id p1so2163849qkm.1
        for <internals@lists.php.net>; Thu, 08 Aug 2019 11:10:12 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20161025;
        h=x-gm-message-state:mime-version:references:in-reply-to:reply-to
         :from:date:message-id:subject:to:cc;
        bh=fheTteBNn7GCNe+wbbXh9rHwkMU29Fv1RdZMWIeK2FI=;
        b=Wi5s1Oyz4I6rD2xHWkd77Yxt33De7kF+HYORGCHKeLrdw5w5SnlykLVEL/4HHJJvVq
         Vt8jiZHN/fZ+Ow9ea02lAKVpL58R5lY2lY2eqLCzXl/jFAXFXl5/TasAgmC7qH5LMVwI
         3kIDTo2aCGPYTGQ1SpYHGTgm09qF6wvCCYZIUEigpMaFIHSaAibUN6J0mQCWh71yczcg
         +ZN7CKxIhVPGHiKt6TtyOv3vXC+L4KPlu2adSsEiviWJ1g5P8F9n5pOst7KSkEhW1x1U
         JmYdgc+R74wP2wiY1r14O99PLbRzQaC+Ckv+Q5AyFVWzouUEVM+w2CK8r2tMnvLLgPKJ
         7quQ==
X-Gm-Message-State: APjAAAWA+hv/BiNWDf/ZuabcMu5lLYMKilvMA5ZWIWoOimKKt+1WlhJs
	KtBrCK8Blh+OoXa0TFazMv3rpGcXHlqpXg2L2XI=
X-Google-Smtp-Source: APXvYqx4rlHBZBgy6yoXr6+MURhkTg0Uaj+ti14fQryeJC0NfUQie9ge50liE3xfDrCVRUox36CG+3lHSwZmyAA+7lo=
X-Received: by 2002:a37:97c1:: with SMTP id z184mr14818702qkd.198.1565287811647;
 Thu, 08 Aug 2019 11:10:11 -0700 (PDT)
MIME-Version: 1.0
References: <CAFPFaML19B_RehrUQLEy_oFae-H5r3+BpUGg=GF1js83cJpJqQ@mail.gmail.com>
In-Reply-To: <CAFPFaML19B_RehrUQLEy_oFae-H5r3+BpUGg=GF1js83cJpJqQ@mail.gmail.com>
Reply-To: bishop@php.net
Date: Thu, 8 Aug 2019 14:09:45 -0400
Message-ID: <CAEYWF=4cx_i=3rCfFKeBT0Jq0e4=P0PeY2wd6YEwog_VdA1+Dg@mail.gmail.com>
To: "G. P. B." <george.banyard@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000fc0ebc058f9ef775"
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecate PHP's short open tags, again
From: bishop@php.net (Bishop Bettini)

--000000000000fc0ebc058f9ef775
Content-Type: text/plain; charset="UTF-8"

On Tue, Aug 6, 2019 at 7:34 AM G. P. B. <george.banyard@gmail.com> wrote:

> The voting for the "Deprecate short open tags, again" [1] RFC has begun.
> It is expected to last two (2) weeks until 2019-08-20.
>
> A counter argument to this RFC is available at
> https://wiki.php.net/rfc/counterargument/deprecate_php_short_tags
>
> Best regards
>
> George P. Banyard
>
> [1] https://wiki.php.net/rfc/deprecate_php_short_tags_v2


I voted "yes" for removal. <? is a security risk. If your code uses <?,
then your code is liable to leak, based entirely on a setting potentially
out of your control. As Robert Korulczyk's example illustrates, even within
the same organization, misconfigurations can have hidden and drastic
consequences.

<? is a security risk today, just as much as it was then. Remember in 2007
when Facebook's source code leaked precisely because of this [1]?

Much has been said about this being a "portability" issue. I think that's
overly specific. The core issue is "fallibility". You can globally
configure the language to stop recognizing itself as a language. That's
weird and unexpected. So much so, that no one gives due thought to this,
and we end up with security disasters.

PHP.net has opined, for years, that <? is bad[2]. It's time to act. So much
else breaks at the 8.0 boundary, let's do it all at once. If anyone needs
to justify the effort, let them say "<? is a security hole".

[1]:https://techcrunch.com/2007/08/11/facebook-source-code-leaked/
[2]:https://www.php.net/manual/en/language.basic-syntax.phptags.php

--000000000000fc0ebc058f9ef775--