Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:33247
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: unknown (pb1.pair.com: domain php.net does not designate 212.55.154.23 as permitted sender)
Message-ID: <006101c829d9$5e2f0140$4101a8c0@pc07653>
To: "Stefan Esser" <stefan.esser@sektioneins.de>,
	"PHP internals" <internals@lists.php.net>
References: <47401946.2050406@sektioneins.de>
Date: Sun, 18 Nov 2007 11:51:33 -0000
MIME-Version: 1.0
Content-Type: text/plain;
	format=flowed;
	charset="ISO-8859-15";
	reply-type=original
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Tainted Mode Decision
From: nlopess@php.net ("Nuno Lopes")

> I just wanted to ask if there was ever a decision made that said tainted
> mode will go into PHP mainstream.

no, there was no decision yet.


> It is no secret that I don't like the idea of a taint mode in PHP
> because it cannot be made secure and fast at the same time.

/me too. Although I can't argue about those two implementations because I 
haven't looked at them yet, I think we shouldn't include neither of them in 
the core. At most we could introduce some hooks in the engine to allow these 
kind of extensions to be self-contained and distributed by 3rd parties 
without much trouble.
Also I don't know how GRASP works, but it's very difficult (if not 
impossible) to provide good analysis..

Nuno