Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57649
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <72878E6C-4C17-4D94-9F73-1446769247E1@nopiracy.de>
References: <CALjhHG_wYvJn-Z+x9fJUi+dgmZ+Ha9BD54N5VwhneJM4sg1xBQ@mail.gmail.com>
	<5FB5CFDA-6FE8-4C20-A9B9-7844ED96659B@nopiracy.de>
	<CAEZPtU7jtQTDNpUovxxnDdRunjH9BOdX=WbS8JcGz+5Wkz8ocw@mail.gmail.com>
	<4F2A9378.70803@thelounge.net>
	<4F2AC9CA.2070308@sugarcrm.com>
	<4F2B2ED8.4050900@jimdo.com>
	<72878E6C-4C17-4D94-9F73-1446769247E1@nopiracy.de>
Date: Fri, 3 Feb 2012 10:20:41 +0100
Message-ID: <CAEZPtU5CP3GqUnKsxx51-ieHAdGh=ySvZCWhhAwa0kwuNG6Bhg@mail.gmail.com>
To: Stefan Esser <stefan@nopiracy.de>
Cc: Soenke Ruempler - Jimdo <soenke@jimdo.com>, PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Suhosin patch disabled by default in Debian php5 builds
From: pierre.php@gmail.com (Pierre Joye)

hi Stefan,

On Fri, Feb 3, 2012 at 9:24 AM, Stefan Esser <stefan@nopiracy.de> wrote:
> Hello Soenke,
>
>> I know it's hard because he personally attacks people and this doesn't
>> help at all, but deal with him. He really made PHP and the interwebs
>> more secure for the last decade.
>>
>> Do not respect him for how (bad) he's communicating things, respect him
>> for what he coded. We are coders.
>
> I am not attacking people personally. Telling someone that he looks very =
stupid, because he did something stupid is not a personal attack. It is sta=
ting the facts.

OH! Please! Please! Can we move this discussion at a technical level?

> How does it not look stupid for the "lead" maintainer of PHP in Debian* t=
o write a "We do not need Suhosin, because I believe there will be no futur=
e Bugs in PHP" mail the very same day various PHP distributions have to put=
 out updates because of a critical security bug that INFACT is mititgated b=
y PHP.
> People don't get that saying we do not need Suhosin because there have be=
en no such critical bugs is like saying: we code perfectly we do not need A=
SLR, NX, Fortify Source, ...

Again, please tell me which part of Suhosin would make sense to have
in the core? With technical explanation or details. Then we can begin
a good discussion and maybe a RFC to get them in.

Cheers,
--=20
Pierre

@pierrejoye | http://blog.thepimp.net | http://www.libgd.org