Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:53149
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.42 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :cc:content-type;
        b=KorRpoJNB4tQQ1evql7lHmtHtzEW9MlyIs9+jQ89kkUvnjQqBjDOXCC2dXkVLglPif
         93HI30jwlc0CqKdD6koVs5g2T7yhbx5Q2YyJQ5r29ozYDp0ZznS4JvJhMopmV+wuCNMI
         uu5Pez4+UB9JMsVnUHDv+Byz3T+MnwF0tPaoQ=
MIME-Version: 1.0
In-Reply-To: <BANLkTikdUuaBv5i3y70axCLb6oYnutHNrw@mail.gmail.com>
References: <8757232E56758B42B2EE4F9D2CA019C901499F97@US-EX2.zend.net>
	<BANLkTikau4c4-HzkGAXG15AMS2tr6fe+NA@mail.gmail.com>
	<97.45.23189.8060DED4@pb1.pair.com>
	<BANLkTinULsKfi5MUF0GA4v9z076zqRc_OA@mail.gmail.com>
	<BANLkTinOKLQ0CEwJaOEJZZNgF23U6OjWSA@mail.gmail.com>
	<4DED5F9B.7060101@thelounge.net>
	<BANLkTik8_pD8tZRBZ+So52S9Gi29CuD57w@mail.gmail.com>
	<4DEDC9F5.3030403@thelounge.net>
	<4DEDF049.7050504@gmail.com>
	<4DEDF216.6070308@thelounge.net>
	<4DEE1D47.8060209@gmail.com>
	<4DEE21C2.5060305@thelounge.net>
	<BANLkTikJFejYK07e2bapX0Hh4D97MtjdeA@mail.gmail.com>
	<4DEE2332.3050705@thelounge.net>
	<BANLkTikdUuaBv5i3y70axCLb6oYnutHNrw@mail.gmail.com>
Date: Tue, 7 Jun 2011 11:59:31 -0300
Message-ID: <BANLkTimFaei0cYH3mwxE2VrTw3V204sabA@mail.gmail.com>
To: Ferenc Kovacs <info@tyrael.hu>
Cc: Reindl Harald <h.reindl@thelounge.net>, internals@lists.php.net
Content-Type: multipart/alternative; boundary=90e6ba53b070b2894f04a5207724
Subject: Re: [PHP-DEV] Bundling "modern" extensions
From: martinscotta@gmail.com (Martin Scotta)

--90e6ba53b070b2894f04a5207724
Content-Type: text/plain; charset=ISO-8859-1

 Martin Scotta


On Tue, Jun 7, 2011 at 10:36 AM, Ferenc Kovacs <info@tyrael.hu> wrote:

> On Tue, Jun 7, 2011 at 3:10 PM, Reindl Harald <h.reindl@thelounge.net
> >wrote:
>
> >
> >
> > Am 07.06.2011 15:08, schrieb Ferenc Kovacs:
> > > On Tue, Jun 7, 2011 at 3:04 PM, Reindl Harald <h.reindl@thelounge.net
> > >wrote:
> > >
> > >>
> > >>
> > >> Am 07.06.2011 14:44, schrieb David Muir:
> > >>> On 07/06/11 18:40, Reindl Harald wrote:
> > >>>> there is a reason for example to disallow many functions
> > >>>> on a webserver - so every API has to make sure they
> > >>>> can not be bypassed
> > >>>>
> > >>>> "because we can" is no valid reason for everything because
> > >>>> we can install binary extension as they exist now and
> > >>>> if you can not you are missing the permissions for some
> > >>>> good reasons
> > >>>>
> > >>>
> > >>> So you're saying that PECL, PNI or FFI should should be actively
> > >>> discouraged because of security concerns?
> > >>
> > >> WHERE i said this?
> > >> PECL-Extensions can NOT be enabled by the user
> > >>
> > >>
> > > except if dl is enabled of course.
> >
> > i think nobody out there will enable this and hope such
> > crazy things are not enabled by default!
> >
> >
> sadly there are many crazy people out there:
>
> http://www.google.hu/#sclient=psy&hl=hu&source=hp&q=intitle:phpinfo()+enable_dl&aq=f&aqi=&aql=&oq=&pbx=1&bav=on.2,or.r_gc.r_pw.&fp=580ca0074daf5780&biw=1280&bih=939
>
>
Most admins are not even aware of this, others really don't care -- how many
host are up to date?
So why relying on them?


> Tyrael
>

--90e6ba53b070b2894f04a5207724--