Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57709
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.210.42 as permitted sender)
References: <CALjhHG_wYvJn-Z+x9fJUi+dgmZ+Ha9BD54N5VwhneJM4sg1xBQ@mail.gmail.com> <5FB5CFDA-6FE8-4C20-A9B9-7844ED96659B@nopiracy.de> <CAEZPtU7jtQTDNpUovxxnDdRunjH9BOdX=WbS8JcGz+5Wkz8ocw@mail.gmail.com> <4F2A9378.70803@thelounge.net> <4F2AC9CA.2070308@sugarcrm.com> <4F2B2ED8.4050900@jimdo.com> <72878E6C-4C17-4D94-9F73-1446769247E1@nopiracy.de> <CAEZPtU5CP3GqUnKsxx51-ieHAdGh=ySvZCWhhAwa0kwuNG6Bhg@mail.gmail.com> <A33C7716-F355-455E-863D-5458205C3208@nopiracy.de> <4F2CEA7E.9010906@sugarcrm.com> <A633CF2D7C7BED41B41F1E64F25507B8069D29BD16@MAILR001.mail.lan>
In-Reply-To: <A633CF2D7C7BED41B41F1E64F25507B8069D29BD16@MAILR001.mail.lan>
Mime-Version: 1.0 (1.0)
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii
Message-ID: <20ECA5EA-A653-499B-95E4-F31E094970A2@gmail.com>
Cc: Stas Malyshev <smalyshev@sugarcrm.com>,
 Stefan Esser <stefan@nopiracy.de>, Pierre Joye <pierre.php@gmail.com>,
 Soenke Ruempler - Jimdo <soenke@jimdo.com>,
 PHP internals <internals@lists.php.net>,
 "security@php.net" <security@php.net>, "zigo@debian.org" <zigo@debian.org>
Date: Sat, 4 Feb 2012 11:11:28 -0700
To: John Crenshaw <johncrenshaw@priacta.com>
Subject: Re: [PHP-DEV] Suhosin patch disabled by default in Debian php5 builds
From: jason.gerfen@gmail.com ("jason.gerfen@gmail.com")

+1

Not certain about a better solution but there are other methods of encryptin=
g and decrypting session data. In a recent project I have been tasked with i=
mplementing a pdo stored procedure using mysql's aes functionality works wel=
l with or without the patch. In a lot of ways I think that is the benefit of=
 any programming language. The tools exist, implement them right?

Jas

On Feb 4, 2012, at 10:21 AM, John Crenshaw <johncrenshaw@priacta.com> wrote:=


> OK, All the mud slinging is getting really silly (on *both* sides). There'=
s no need to denigrate others because you don't agree with them. There's no p=
oint in arguing about who isn't a team player or who works for which evil mu=
ltinational corporation. Nobody is attacking anybody else by suggesting that=
 Suhosin is or is not critical, and none of that really matters anyway.
>=20
> I may have missed something, but has anyone asked *why* the patch was disa=
bled? I think I could make a good guess, but I haven't seen even the slighte=
st hint of the actual reasons in this email chain (though I could easily hav=
e missed it entirely).
>=20
> IMO we should try to focus on:
> 1. What are the pros vs. cons of enabling the Suhosin patch by default?
> 2. Why did the Debian team opt to disable it?
> 3. Are there better solutions that should be considered and recommended?
>=20
> John Crenshaw
> Priacta, Inc.
>=20
> --=20
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>=20