Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122835
Content-Type: text/plain;
	charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.500.171.1.1\))
Subject: Re: [PHP-DEV] Consider removing autogenerated files from tarballs
Date: Sun, 31 Mar 2024 15:53:54 +0200
References: <AM8P250MB01705B564C0F9B2F460F56B0E2392@AM8P250MB0170.EURP250.PROD.OUTLOOK.COM>
 <9008050F-4EE1-4E19-B513-654602E118A7@benramsey.com>
 <3d90e236-49d8-4f80-a6dd-3584267a83e3@php.net>
 <586c3320-b38b-47bb-9c06-6762f1eb242b@gmail.com>
 <cc1e1415-a4cd-4bb2-99f0-e5b05ef6582c@gmail.com>
 <CAEKnhAEMAmgoFmgCPOnV_0sxpaB5SNwRo-qFcE_YeLSduq+bHg@mail.gmail.com>
 <1c7bcd0e-4e32-480f-acd2-2c8eb049bde2@gmail.com>
To: php internals <internals@lists.php.net>
In-Reply-To: <1c7bcd0e-4e32-480f-acd2-2c8eb049bde2@gmail.com>
Message-ID: <3E13B046-FE40-48D7-AAF0-13362B12C438@cschneid.com>
From: cschneid@cschneid.com (Christian Schneider)

Am 30.03.2024 um 16:35 schrieb Daniil Gentili =
<daniil.gentili@gmail.com>:
>> That would break lots of tools as it requires extra dependencies so =
it is not something that would could in stable versions.
> Btw, I do not believe that "it would require end users to install =
autotools and bison in order to compile PHP from tarballs" is valid =
reason to delay the patching of a serious attack vector ASAP.

I agree with Jakub that removing configure would just shift the problem, =
not solve it, while at the same time puts a new burden on people =
compiling PHP from downloaded archives.

But my main question is: I fail to see the difference whether I plant my =
malicious code in configure, configure.ac or *.c: Someone has to review =
the changes and notice the problem. And we have to trust the RMs. What =
am I missing?

Regards,
- Chris