Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:27052
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 66.249.82.224 as permitted sender)
DomainKey-Status: good
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=gmail.com;
        h=received:in-reply-to:references:mime-version:content-type:message-id:cc:content-transfer-encoding:from:subject:date:to:x-mailer:sender;
        b=UaCUwY7T4LZFqW9csCNnQrp82SiZUHAGECdx4WTcchfa6ZYqfLcH1xqRg2vSF3psUoRLJ7C3nDfVUGS73sm/ufCgRN1tKbmV9W1BxGoQSlcMRR107W7T/IaYLosJRF63aGkcyboPqo+lWlQNERLkPHCFFm2YW/kqHAuI84XEM2A=
In-Reply-To: <45846491.6020101@zend.com>
References: <20061215201448.B16D8BC1AB@spike.porcupine.org> <7AE00699-23C2-4759-A50C-3D94199DA85A@prohost.org> <45831090.1000704@zend.com> <18A7CF93-7BFD-4764-847D-6C107A62875E@prohost.org> <45831A87.6050301@zend.com> <EED341E1-CC7E-4573-BF76-1EE50B01C7A1@prohost.org> <45832B9B.2080109@zend.com> <8BC86061-CCC5-45C3-8C40-92B06ADBB117@prohost.org> <45832F71.2080503@zend.com> <7C8CB695-3E81-4009-9699-2499DBF7B366@prohost.org> <4583375C.5060302@zend.com> <2F093E93-7021-4C0F-A391-A99CBF080596@prohost.org> <45833C93.4020909@zend.com> <87774C2D-1959-459A-B892-F2F6F6A5C676@prohost.org> <45835ABE.5040909@zend.com> <6526D55D-DC87-40D4-8335-CCB0FA810646@prohost.org> <45846491.6020101@zend.com>
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-ID: <7FD783B9-68A7-4EC7-B6C3-8DBC44A51597@prohost.org>
Cc: PHP internals <internals@lists.php.net>
Content-Transfer-Encoding: 7bit
Date: Sat, 16 Dec 2006 16:40:01 -0500
To: Stanislav Malyshev <stas@zend.com>
Sender: Ilia Alshanetsky <iliaal@gmail.com>
Subject: Re: [PHP-DEV] Run-time taint support proposal
From: ilia@prohost.org (Ilia Alshanetsky)


On 16-Dec-06, at 4:26 PM, Stanislav Malyshev wrote:

> If you know of vulnerability on zend.com, please write to  
> webmaster@zend.com, that would be only responsible course of  
> action. However, I do not see how having vulnerabilities imply not  
> caring for security.

That's my point (and for record previous exploits in the Zend site  
were reported several times) just because a mistake was made does not  
mean you don't care about security. Same logic must apply to phpinfo 
(), someone created it for debugging and forgot to remove and the  
search engine stumbled across it. It happens.

>> You're not helping them, just making assumptions about how their  
>> code should work and making them adhere to them.
>
> Yes, and this is helping. Every language does that. Saying "you  
> can't make 100% work exactly as I wanted without any effort, so  
> entire thing isn't even worth discussing" is a road nowhere.  
> There's a lot of places it would be helpful, and there's a lot of  
> places it won't - and that's ok.

I am saying that you should not try to outsmart the developer because  
you assume you know best.

Ilia Alshanetsky