Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124820
Precedence: bulk
MIME-Version: 1.0
References: <e08f6af322dcc5b4e4dd5e772f28be07ffa07ba4.camel@ageofdream.com>
 <c510eb675bd0038efbbe5489bebd42ff7438e967.camel@ageofdream.com>
 <7d9a9752-a202-4099-a60a-2686d4265d96@gmail.com> <ffc9c850-06f1-4937-be55-b9e2cc614dfb@app.fastmail.com>
In-Reply-To: <ffc9c850-06f1-4937-be55-b9e2cc614dfb@app.fastmail.com>
Date: Wed, 7 Aug 2024 18:02:06 +0700
Message-ID: <CAEZPtU4-Qtvx_OkKtM45erUtemjJeHA=qVkpBid1pX0sO=SKPg@mail.gmail.com>
Subject: Re: [PHP-DEV] [Discussion] Sandbox API
To: Rob Landers <rob@bottled.codes>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000f2d12f061f15d7a7"
From: pierre.php@gmail.com (Pierre Joye)

--000000000000f2d12f061f15d7a7
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, Aug 7, 2024, 2:11=E2=80=AFAM Rob Landers <rob@bottled.codes> wrote:

>
> I find this assertion kind of scary from a shared hosting perspective or
> even from a 3v4l kind of perspective. How do these services protect
> themselves if php is inherently insecure?
>

php is not inherently insecure. not even remotely and quite the opposite.

Shared hosting is.

This is issue is not specific to php, almost all languages out there will
have the same memory (or else) challenges.

Crypto apis or similar features requiring high level of safety for the data
use various technics to mitigate it (zeroing after use, decrypt mem on
demand only etc).

A bit off topic but with the solutions out there for vps, etc, shared
hosting for anything requiring data safety should be avoided like the pest.


About this feature, it looks, at a first glance,  like an advanced complex
version of safe mode/open base dir, with the additional features. I never
ever had to mock core functions for testing, I would think about a design
issue if it is needed.


But I may be wrong, that would not be a first  :)


cheers,
Pierre

--000000000000f2d12f061f15d7a7
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto"><div><br><br><div class=3D"gmail_quote"><div dir=3D"ltr" =
class=3D"gmail_attr">On Wed, Aug 7, 2024, 2:11=E2=80=AFAM Rob Landers &lt;r=
ob@bottled.codes&gt; wrote:</div><blockquote class=3D"gmail_quote" style=3D=
"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><=
br></div><div>I find this assertion kind of scary from a shared hosting per=
spective or even from a 3v4l kind of perspective. How do these services pro=
tect themselves if php is inherently insecure?</div></div></blockquote></di=
v></div><div dir=3D"auto"><br></div><div dir=3D"auto">php is not inherently=
 insecure. not even remotely and quite the opposite.</div><div dir=3D"auto"=
><br></div><div dir=3D"auto">Shared hosting is.</div><div dir=3D"auto"><br>=
</div><div dir=3D"auto">This is issue is not specific to php, almost all la=
nguages out there will have the same memory (or else) challenges.</div><div=
 dir=3D"auto"><br></div><div dir=3D"auto">Crypto apis or similar features r=
equiring high level of safety for the data use various technics to mitigate=
 it (zeroing after use, decrypt mem on demand only etc).</div><div dir=3D"a=
uto"><br></div><div dir=3D"auto">A bit off topic but with the solutions out=
 there for vps, etc, shared hosting for anything requiring data safety shou=
ld be avoided like the pest.=C2=A0</div><div dir=3D"auto"><br></div><div di=
r=3D"auto"><br></div><div dir=3D"auto">About this feature, it looks, at a f=
irst glance,=C2=A0 like an advanced complex version of safe mode/open base =
dir, with the additional features. I never ever had to mock core functions =
for testing, I would think about a design issue if it is needed.</div><div =
dir=3D"auto"><br></div><div dir=3D"auto"><br></div><div dir=3D"auto">But I =
may be wrong, that would not be a first=C2=A0 :)</div><div dir=3D"auto"><br=
></div><div dir=3D"auto"><br></div><div dir=3D"auto">cheers,=C2=A0</div><di=
v dir=3D"auto">Pierre</div><div dir=3D"auto"></div></div>

--000000000000f2d12f061f15d7a7--