Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57612
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain nopiracy.de from 81.169.146.162 cause and error)
Mime-Version: 1.0 (Apple Message framework v1251.1)
Content-Type: text/plain; charset=utf-8
In-Reply-To: <CALjhHG_wYvJn-Z+x9fJUi+dgmZ+Ha9BD54N5VwhneJM4sg1xBQ@mail.gmail.com>
Date: Thu, 2 Feb 2012 14:31:08 +0100
Cc: 657698 <657698@bugs.debian.org>,
 Christoph Anton Mitterer <calestyo@scientia.net>,
 Douglas Calvert <dfc@douglasfcalvert.net>,
 Jesse Molina <jesse@opendreams.net>,
 Carlos Alberto Lopez Perez <clopez@igalia.com>,
 PHP internals <internals@lists.php.net>,
 Debian Developers <debian-devel@lists.debian.org>,
 Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>
Content-Transfer-Encoding: quoted-printable
Message-ID: <5FB5CFDA-6FE8-4C20-A9B9-7844ED96659B@nopiracy.de>
References: <CALjhHG_wYvJn-Z+x9fJUi+dgmZ+Ha9BD54N5VwhneJM4sg1xBQ@mail.gmail.com>
To: =?utf-8?Q?Ond=C5=99ej_Sur=C3=BD?= <ondrej@sury.org>
Subject: Re: [PHP-DEV] Suhosin patch disabled by default in Debian php5 builds
From: stefan@nopiracy.de (Stefan Esser)

Hello Ond=C5=99ej,

> My personal feeling is that most people see suhosin as "this is about
> security, thus it must be good". This combined with bad PHP security
> history makes everybody feel insecure when suhosin was removed, but
> the real question is if the suhosin is still really helping with PHP
> security or it is just a burden in the general installations now.

considering the fact that you write this email the very same day that a =
remote code execution vulnerability in PHP is found that is easy to =
exploit from remote and is greatly mitigated by the use of Suhosin you =
look pretty stupid. (In case of usage of Suhosin-Extension in default =
config, it is even completely killed).

Just saying.


Regards,
Stefan Esser