Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57681
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain nopiracy.de from 81.169.146.162 cause and error)
Mime-Version: 1.0 (Apple Message framework v1251.1)
Content-Type: text/plain; charset=iso-8859-1
In-Reply-To: <4F2CF2DB.7000605@sugarcrm.com>
Date: Sat, 4 Feb 2012 10:08:03 +0100
Cc: Pierre Joye <pierre.php@gmail.com>,
 Soenke Ruempler - Jimdo <soenke@jimdo.com>,
 PHP internals <internals@lists.php.net>,
 "security@php.net" <security@php.net>,
 "zigo@debian.org" <zigo@debian.org>
Content-Transfer-Encoding: quoted-printable
Message-ID: <86A9EDF4-1EF0-40B9-AFE8-2667BB036F6F@nopiracy.de>
References: <CALjhHG_wYvJn-Z+x9fJUi+dgmZ+Ha9BD54N5VwhneJM4sg1xBQ@mail.gmail.com> <5FB5CFDA-6FE8-4C20-A9B9-7844ED96659B@nopiracy.de> <CAEZPtU7jtQTDNpUovxxnDdRunjH9BOdX=WbS8JcGz+5Wkz8ocw@mail.gmail.com> <4F2A9378.70803@thelounge.net> <4F2AC9CA.2070308@sugarcrm.com> <4F2B2ED8.4050900@jimdo.com> <72878E6C-4C17-4D94-9F73-1446769247E1@nopiracy.de> <CAEZPtU5CP3GqUnKsxx51-ieHAdGh=ySvZCWhhAwa0kwuNG6Bhg@mail.gmail.com> <A33C7716-F355-455E-863D-5458205C3208@nopiracy.de> <4F2CEA7E.9010906@sugarcrm.com> <9684A843-5A7F-43BB-BFC2-86F34E27EC3B@nopiracy.de> <4F2CF2DB.7000605@sugarcrm.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Subject: Re: [PHP-DEV] Suhosin patch disabled by default in Debian php5 builds
From: stefan@nopiracy.de (Stefan Esser)

Hello Stas,

> That's your opinion and you completely entitled to it and I have =
absolutely no issue about it. As I have no issue with your preferring to =
keep Suhosin as a separate project - it's your code, you decide what to =
do with it. What I have an issue with is understanding how, after all =
public invitations and discussion, you claim that we refuse to cooperate =
and "fight you like cancer".
The problem is when people like Pierre run around and tell in public =
that people have only more problems due to Suhosin, that he is happy =
that distributions kick it. He also tells everybody that he sees no need =
in any of the Suhosin features and is VERY VOCAL about it. Nevertheless =
PHP 5.3.9 introduced a vulnerability because PHP.net cloned one of those =
"we see no need for any features" features.

Also Pierre runs around every time I mention that Suhosin is not bitten =
by a bug and accuses me of blatant advertisement or he just downplays =
the fact that Suhosin users were relatively save from the critical major =
vulnerability in PHP 5.3.9.

He is actively lobbying against Suhosin and spreading FUD. That is =
pretty much like fighting it like cancer.

> Nobody demands anything from you. However, for a feature to be =
included in PHP it needs to go through certain process. It's not because =
we hate you and this process is not personal for you,
Please read the email form Pierre: I see no sense in other features of =
Suhosin. Write some RFC to convince us to include them.

And BTW you cannot play the: It is Pierre you know him card. The PHP =
developers are free to step up and say publicly that Pierre's view is =
not that of the developers. But you choose to not to do so. So you are =
behind him.

Regards,
Stefan=