Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:33092
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 64.233.162.239 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth;
        b=An+041dLfx8yDUXzPloDZ7TwpUSOmXMCbbvLgJTaimaxO4BAzyC6ZmZnrPl0vsGcFM0F05Fhi4fr32Jbo6nSTG8wAwb+5Oi32FlkKlsqKBR/rqlPg3TOkraBcDQsCmp3duPCIlEQ0sA6wKMpUBzmS4XVHnaGhXSjWBz1DD/3Ui4=
Message-ID: <b5f7bf6c0711111329m75d8168cq880839faadeaa5d@mail.gmail.com>
Date: Sun, 11 Nov 2007 16:29:15 -0500
Sender: david.coallier@gmail.com
To: "Stanislav Malyshev" <stas@zend.com>
Cc: "PHP Internals" <internals@lists.php.net>
In-Reply-To: <47363057.70209@zend.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <b5f7bf6c0711092032s293d1c7fuadcd11408a2a1a60@mail.gmail.com>
	 <47363057.70209@zend.com>
Subject: Re: [PHP-DEV] Question about Core inclusion
From: davidc@php.net ("David Coallier")

On Nov 10, 2007 5:27 PM, Stanislav Malyshev <stas@zend.com> wrote:
> > Hey there all, over the past few days I was thinkering over something
> > that I consider could be a good addition to the core or actually to
> > the php distribution. PhpSecInfo, the project by Ed Finkler. I was
>
> But isn't it a set of PHP scripts? If so, what would be the value of
> making it an extension? There are a lot of very useful PHP scripts,
> which aren't part of core PHP.

Yes there are a lot of very useful packages, but I think this one
could be very good but not only for the users but also php's general
security image/reputation. Yes many settings can be set in a way that
make PHP less safe than what it can be and helping our users getting
towards a more secure application and dev process would be optimal and
very cool.

Simple in ext/ where one could go like --enable-security-info ....

But yeah, I won't be mad if we decide it's a bit useless for the core
but I think it would be a good "feature" add for PHP6 and perhaps even
a bit of press coverage about php's security, but good press :P


> --
> Stanislav Malyshev, Zend Software Architect
> stas@zend.com   http://www.zend.com/
> (408)253-8829   MSN: stas@zend.com
>



-- 
David Coallier,
Founder & Software Architect,
Agora Production (http://agoraproduction.com)
51.42.06.70.18