Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:106452
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
	s=turbo-smtp; d=php.net;
	h=Received:Received:X-TurboSMTP-Tracking:X-Gm-Message-State:X-Google-Smtp-Source:X-Received:MIME-Version:References:In-Reply-To:From:Date:X-Gmail-Original-Message-Id:Message-ID:Subject:To:Cc:Content-Type;
	b=n3mSmUZhoHsQL+MJmpLM9e25Uf9PMh9uSwWL1pM4GfRLYhLDBz0vA1cLtbfHoS
	ubQ6PBrZYqXKjd3pclOV6jbqLC5APpQPgI5wfbMh/iUTjb5DkhmdcFNheKn+zoqo
	GQM9OyQryB07Fu2kd7YBauD6/+ibHJRLgVKAhuac3bvZI=;
MIME-Version: 1.0
References: <CAFPFaML19B_RehrUQLEy_oFae-H5r3+BpUGg=GF1js83cJpJqQ@mail.gmail.com> <CAEYWF=4cx_i=3rCfFKeBT0Jq0e4=P0PeY2wd6YEwog_VdA1+Dg@mail.gmail.com> <CAJHtznzie34C92y2nTRXxhD99FEW-5hmruVatsrLDHcAKvTccQ@mail.gmail.com>
In-Reply-To: <CAJHtznzie34C92y2nTRXxhD99FEW-5hmruVatsrLDHcAKvTccQ@mail.gmail.com>
Date: Thu, 8 Aug 2019 22:43:01 +0300
Message-ID: <CAJHtznzSbM-Gpq=Wt+oRVXAJK=MChcNNECv2jX7TiVwTMo-XFw@mail.gmail.com>
To: bishop@php.net
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000ab767a058fa044f4"
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecate PHP's short open tags, again
From: zeev@php.net (Zeev Suraski)

--000000000000ab767a058fa044f4
Content-Type: text/plain; charset="UTF-8"

On Thu, Aug 8, 2019 at 10:35 PM Zeev Suraski <zeev@php.net> wrote:

>
>
> On Thu, Aug 8, 2019 at 9:10 PM Bishop Bettini <bishop@php.net> wrote:
>
>> On Tue, Aug 6, 2019 at 7:34 AM G. P. B. <george.banyard@gmail.com> wrote:
>>
>> > The voting for the "Deprecate short open tags, again" [1] RFC has begun.
>> > It is expected to last two (2) weeks until 2019-08-20.
>> >
>> > A counter argument to this RFC is available at
>> > https://wiki.php.net/rfc/counterargument/deprecate_php_short_tags
>> >
>> > Best regards
>> >
>> > George P. Banyard
>> >
>> > [1] https://wiki.php.net/rfc/deprecate_php_short_tags_v2
>>
>> <? is a security risk today, just as much as it was then. Remember in 2007
>> when Facebook's source code leaked precisely because of this [1]?
>>
>
> Where's the evidence that it was precisely or even remotely because of
> this?
>

I'd like to add that looking at the source code[1] from the leaks, it
appears to be using long tags - which means that if it is authentic - short
tags were not the source of the leak.
Also, there was a Perl leak[2] from Facebook as well.  It's a bit difficult
to blame short tags for that one.

Zeev

[1] https://gist.github.com/nikcub/3833406
[2] https://gist.github.com/philfreo/7257723

--000000000000ab767a058fa044f4--