Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:53138
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.83.42 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:sender:in-reply-to:references:date
         :x-google-sender-auth:message-id:subject:from:to:cc:content-type;
        b=c8OFZG4/ITW5nKltNPSQhEq9DKkcV2AlqrlMoO7wxCXWGtMnn2Dr5D40RcnMNM9h1F
         joltUErPbDhG9V+l/AdFje07XHrml8uZEgNm4kjLBfPZf7nQN0TqT8sqRFJloB88dCSh
         HMeXjswvYWtOs4srDZ2BJzr1HZZtacQPVJRQQ=
MIME-Version: 1.0
Sender: tyra3l@gmail.com
In-Reply-To: <4DEE2332.3050705@thelounge.net>
References: <8757232E56758B42B2EE4F9D2CA019C901499F97@US-EX2.zend.net>
	<BANLkTikau4c4-HzkGAXG15AMS2tr6fe+NA@mail.gmail.com>
	<97.45.23189.8060DED4@pb1.pair.com>
	<BANLkTinULsKfi5MUF0GA4v9z076zqRc_OA@mail.gmail.com>
	<BANLkTinOKLQ0CEwJaOEJZZNgF23U6OjWSA@mail.gmail.com>
	<4DED5F9B.7060101@thelounge.net>
	<BANLkTik8_pD8tZRBZ+So52S9Gi29CuD57w@mail.gmail.com>
	<4DEDC9F5.3030403@thelounge.net>
	<4DEDF049.7050504@gmail.com>
	<4DEDF216.6070308@thelounge.net>
	<4DEE1D47.8060209@gmail.com>
	<4DEE21C2.5060305@thelounge.net>
	<BANLkTikJFejYK07e2bapX0Hh4D97MtjdeA@mail.gmail.com>
	<4DEE2332.3050705@thelounge.net>
Date: Tue, 7 Jun 2011 15:36:09 +0200
Message-ID: <BANLkTikdUuaBv5i3y70axCLb6oYnutHNrw@mail.gmail.com>
To: Reindl Harald <h.reindl@thelounge.net>
Cc: internals@lists.php.net
Content-Type: multipart/alternative; boundary=000e0cd39a6a79417204a51f4d3e
Subject: Re: [PHP-DEV] Bundling "modern" extensions
From: info@tyrael.hu (Ferenc Kovacs)

--000e0cd39a6a79417204a51f4d3e
Content-Type: text/plain; charset=UTF-8

On Tue, Jun 7, 2011 at 3:10 PM, Reindl Harald <h.reindl@thelounge.net>wrote:

>
>
> Am 07.06.2011 15:08, schrieb Ferenc Kovacs:
> > On Tue, Jun 7, 2011 at 3:04 PM, Reindl Harald <h.reindl@thelounge.net
> >wrote:
> >
> >>
> >>
> >> Am 07.06.2011 14:44, schrieb David Muir:
> >>> On 07/06/11 18:40, Reindl Harald wrote:
> >>>> there is a reason for example to disallow many functions
> >>>> on a webserver - so every API has to make sure they
> >>>> can not be bypassed
> >>>>
> >>>> "because we can" is no valid reason for everything because
> >>>> we can install binary extension as they exist now and
> >>>> if you can not you are missing the permissions for some
> >>>> good reasons
> >>>>
> >>>
> >>> So you're saying that PECL, PNI or FFI should should be actively
> >>> discouraged because of security concerns?
> >>
> >> WHERE i said this?
> >> PECL-Extensions can NOT be enabled by the user
> >>
> >>
> > except if dl is enabled of course.
>
> i think nobody out there will enable this and hope such
> crazy things are not enabled by default!
>
>
sadly there are many crazy people out there:
http://www.google.hu/#sclient=psy&hl=hu&source=hp&q=intitle:phpinfo()+enable_dl&aq=f&aqi=&aql=&oq=&pbx=1&bav=on.2,or.r_gc.r_pw.&fp=580ca0074daf5780&biw=1280&bih=939

Tyrael

--000e0cd39a6a79417204a51f4d3e--