Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:130650
Precedence: list
MIME-Version: 1.0
References: <939CFA28-A6FF-433F-85A0-B83345CEF4A6@cmpct.info>
 <0598E8E2-F795-45E4-9177-0CA1B1808008@cmpct.info> <A458F4A9-1CD7-4ADE-A206-E50D8F6DC3D0@cmpct.info>
 <9F4960AC-3B1B-4174-B37F-19268C846BB0@cmpct.info>
In-Reply-To: <9F4960AC-3B1B-4174-B37F-19268C846BB0@cmpct.info>
Date: Wed, 15 Apr 2026 23:09:57 +0300
Message-ID: <CAPhkiZztUd8wKDn5vDCSAKdLxOs-3js7zMZGP1iNwCjDPhx+Pw@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] Display Function Arguments in Errors
To: Calvin Buckley <calvin@cmpct.info>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000007af38d064f854dae"
From: narf@devilix.net (Andrey Andreev)

--0000000000007af38d064f854dae
Content-Type: text/plain; charset="UTF-8"

Hi,

My last comment (https://externals.io/message/130290#130377) was not
addressed, and I still have two major issues with the RFC as is:
- It is clearly aiming for default of 1 and unreasonably expects all
codebases to be (meticulously) updated with SensitiveParameter attribute -
that is "opt-in security" and not secure by default
- While a "risk of untagged PII in logs" is mentioned, it is done so with
language that severely downplays the issue

Given these, and that the word "security" isn't even mentioned in the RFC,
I don't believe that the security impact is taken seriously at all.

Cheers,
Andrey.

--0000000000007af38d064f854dae
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">Hi,</div><div><br></div><div>My last comm=
ent (<a href=3D"https://externals.io/message/130290#130377">https://externa=
ls.io/message/130290#130377</a>) was not addressed, and I still have two ma=
jor issues with the RFC as is:</div><div>- It is clearly aiming for default=
 of 1 and unreasonably expects all codebases to be (meticulously) updated w=
ith SensitiveParameter attribute - that is &quot;opt-in security&quot; and =
not secure by default</div><div>- While a &quot;risk of untagged PII in log=
s&quot; is mentioned, it is done so with language that severely downplays t=
he issue</div><div><br></div><div>Given these, and that the word &quot;secu=
rity&quot; isn&#39;t even mentioned in the RFC, I don&#39;t believe that th=
e security impact is taken seriously at all.</div><div><br></div><div>Cheer=
s,</div><div>Andrey.</div></div>

--0000000000007af38d064f854dae--