Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:59675
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.161.170 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXZh4uMeUH_BSCFmfNgxS-SZC0svA9BPcSROjwmbfrtFyQ@mail.gmail.com>
References: <CAGa2bXZ6G=Cphjrde3u1Mq3AAw-4yJk3s28vNe+Aybt2nGTumg@mail.gmail.com>
 <CAGa2bXZh4uMeUH_BSCFmfNgxS-SZC0svA9BPcSROjwmbfrtFyQ@mail.gmail.com>
Date: Wed, 11 Apr 2012 06:49:19 +0900
Message-ID: <CAGa2bXbhi4zdgd9Udo6KsoycDwg_Ke0Xe5h3_-fVDMvn_VfAjQ@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: Disabling PHP tags by php.ini and CLI options
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi,

It seems motivation of this RFC is better to be stated.
Motivation to have this RFC is

1. "File Includes" is fatal security breach.
2. The reason why PHP is unsecure to "File Include" than other
language is "Mandatory embed mode"
3. Non mandatory embed mode gives option users to better security.

With this RFC, PHP could be as safe as other scripting languages
with respect to file includes. This RFC is fully compatible with current
code. Writing backward compatible code is as few as 3 lines.

Most of security measures are not perfect solutions, but
mitigation, just like canary and DEP. I suppose people who are
concerned with security understand the value of these protections.

Is there any good reasons not to have non mandatory embed
mode as a additional security measure? Why not to make it harder
for attackers to exploit?

In short, I'm really annoyed to hear "PHP is insecure than
Ruby/Perl/Python/etc"

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net