Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:29624
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: softfail (pb1.pair.com: domain ch2o.info does not designate 212.27.42.35 as permitted sender)
To: "Stanislav Malyshev" <stas@zend.com>, "Stefan Esser"
	 <sesser@hardened-php.net>
Cc: David <planetbeing@gmail.com>, internals@lists.php.net
Reply-To: info@ch2o.info
In-Reply-To: 465149FE.4070100@zend.com
Message-ID: <20070521151449.58bf87d0@taris.localnet>
Date: Mon, 21 May 2007 17:14:49 +0200
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="-----------3e7f540bdfbffbb31e890fc4e1400619"
Subject: Re: [PHP-DEV] Dismantling the lies...
From: info@ch2o.info ("Mathieu CARBONNEAUX")

-------------3e7f540bdfbffbb31e890fc4e1400619
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

=5F=5F=5F=5F=5F =20

From: Stanislav Malyshev [mailto:stas@zend.com]
I don't think they are "not important", just that they are not important=
=20
  enough to want them fixed no matter the cost. Running shared hosted=20
  server in a mode that relies on restricted code IMO is wrong anyway, a=
nd=20
  for non-shared environment these problems could be exploited only if=
=20
  specifically enabled by very badly written code. So when there's a=20
  trade-off between having the language work better for 100% of cases or=
=20
  protect those who run broken code on their servers - the choice would =
be=20
  to make language run better. Again, that doesn't mean bugs shouldn't b=
e=20
  fixed - just the fix shouldn't make the situation worse.why not let th=
e choise to the php user =3F
with configurable option =3F
if the user accept perfomance hit vs security, they configure the option=
...
without run fast but without protection...

it's juste a idea...
Mathieu
-------------3e7f540bdfbffbb31e890fc4e1400619--