Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:29534
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain hardened-php.net from 81.169.159.221 cause and error)
Message-ID: <464EA287.5020605@hardened-php.net>
Date: Sat, 19 May 2007 09:08:55 +0200
User-Agent: Thunderbird 2.0.0.0 (Windows/20070326)
MIME-Version: 1.0
To: Stanislav Malyshev <stas@zend.com>
Cc: Cristian Rodriguez <judas.iscariote@gmail.com>,
	internals@lists.php.net
References: <464DCB8C.90803@chiaraquartet.net> <7d5a202f0705181813l221248cdu85197a82a1ee4227@mail.gmail.com> <464E5856.5000901@zend.com>
In-Reply-To: <464E5856.5000901@zend.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] potential solution to user streams + allow_url_include=off
From: sesser@hardened-php.net (Stefan Esser)

Christian,

I suggest that you simply stop arguing with PHP developers about
security issues.
The problem is that they don't understand them. They are too arrogant.
They actually
believe they know everything better.

In such a situation there is only one healing. Stop giving them tips and
let them
run against walls again and again. With the last X releases and the
again and again
introduced BC breaks and additional security bugs they have pissed off
already
many of their users.

At the moment they are very predictable. You send them a security bug
and first
they try to tell you that you are totally wrong (because you made a
mistake by
sending them a non working example). Then you recommend a way to fix it.
But don't expect that they are fixing it the way you tell them...

They will do something else to prove that they "outsmarted" you. Yeah
guess what
their fix is of course not a solution and as usual fixes just one of the
symptoms.

Stefan Esser