Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:26337
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain hardened-php.net from 81.169.146.188 cause and error)
Date: Sun, 5 Nov 2006 08:55:03 +0100 (MET)
Message-ID: <454D98D7.1060407@hardened-php.net>
User-Agent: Thunderbird 1.5.0.7 (Windows/20060909)
MIME-Version: 1.0
To: Nuno Lopes <nlopess@php.net>
CC: Stanislav Malyshev <stas@zend.com>,  'PHP Internals' <internals@lists.php.net>, Peter Brodersen <penguin@php.net>
References: <454C5E50.4030108@zend.com> <002801c7005d$caf21610$0100a8c0@pc07653> <454D1410.6010700@hardened-php.net> <000f01c70064$c989f660$0100a8c0@pc07653>
In-Reply-To: <000f01c70064$c989f660$0100a8c0@pc07653>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] allow_url_include and php:/data:
From: sesser@hardened-php.net (Stefan Esser)

Hi Nuno,
>
> I was already expecting this kind of answer from you, but you clearly
> don't know me.
> The previous e-mail wasn't a personal attack nor an attack to your
> business, nor I was doing any type of propaganda against you.
Calling my actions unethical and my posts pathetic is kinda a personal
attack in the real world.

> I didn't know that, really. But in theory I'm also a PHP developer
> (although not very active) and I didn't receive any information about
> that.
> So, I don't know who knew that. But if the security team was aware of
> that, I present my excuses to you.
The fact that allow_url_fopen does not affect php://input was not only
brought up by me before but is actively used by skript kiddies for years.
And I really don't like to repeat myself 1000 times.
When I brought this up the response I got was: "Yeah whatever. Stopping
a few URLs is better than stopping none."
>
> If people doesn't know the facts, just explain the things to them
> nicely. No violence is needed, IMHO.
Well PHP developers discuss on IRC how to kill me best by shooting me in
my back. I am just answering in the same tone.

Stefan