Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:57775 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 35908 invoked from network); 6 Feb 2012 17:01:18 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 6 Feb 2012 17:01:18 -0000 Authentication-Results: pb1.pair.com smtp.mail=stefan@nopiracy.de; spf=permerror; sender-id=unknown Authentication-Results: pb1.pair.com header.from=stefan@nopiracy.de; sender-id=unknown Received-SPF: error (pb1.pair.com: domain nopiracy.de from 85.214.103.31 cause and error) X-PHP-List-Original-Sender: stefan@nopiracy.de X-Host-Fingerprint: 85.214.103.31 h1332034.stratoserver.net Linux 2.6 Received: from [85.214.103.31] ([85.214.103.31:52232] helo=mail.sektioneins.de) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id E2/91-27897-657003F4 for ; Mon, 06 Feb 2012 12:01:13 -0500 Received: from [10.23.17.42] (cable-78-34-71-151.netcologne.de [78.34.71.151]) by mail.sektioneins.de (Postfix) with ESMTPSA id 0BC75189C019; Mon, 6 Feb 2012 18:00:54 +0100 (CET) Mime-Version: 1.0 (Apple Message framework v1251.1) Content-Type: text/plain; charset=iso-8859-1 In-Reply-To: Date: Mon, 6 Feb 2012 18:00:53 +0100 Cc: Reindl Harald , Mailing-List php Content-Transfer-Encoding: quoted-printable Message-ID: <293002B6-F4DE-46A6-8541-D11F210F9884@nopiracy.de> References: <4F2CEA7E.9010906@sugarcrm.com> <9684A843-5A7F-43BB-BFC2-86F34E27EC3B@nopiracy.de> <90A22109-8267-4C6F-B35C-0A3612213915@nopiracy.de> <4F2FEE7A.9030309@thelounge.net> <4F2FF2A5.7000906@thelounge.net> <4F2FFE2E.4060102@thel ounge.net> To: Nikita Popov X-Mailer: Apple Mail (2.1251.1) Subject: Re: [PHP-DEV] Suhosin patch disabled by default in Debian php5 builds From: stefan@nopiracy.de (Stefan Esser) Hey Nikita, > Full disclosure sure is controversial, but I don't think it is > regarded as necessarily bad. Just look at the way Stefan disclosed the > PHP 5.3.9 remote code execution vulnerability: Full disclosure. >=20 > So please, again, don't call people names. I guess you are not aware that the bug was disclosed by Stas when he = commited the fix to the SVN. I never told anyone where the bug is before it was already all over the = internet. So please get your facts straight. Regards, Stefam=