Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:62037
Return-Path: <nikita.ppv@gmail.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 97734 invoked from network); 4 Aug 2012 20:03:28 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 4 Aug 2012 20:03:28 -0000
Authentication-Results: pb1.pair.com smtp.mail=nikita.ppv@gmail.com; spf=pass; sender-id=pass
Authentication-Results: pb1.pair.com header.from=nikita.ppv@gmail.com; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.170 as permitted sender)
X-PHP-List-Original-Sender: nikita.ppv@gmail.com
X-Host-Fingerprint: 209.85.217.170 mail-lb0-f170.google.com  
Received: from [209.85.217.170] ([209.85.217.170:59595] helo=mail-lb0-f170.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id BE/32-19861-F008D105 for <internals@lists.php.net>; Sat, 04 Aug 2012 16:03:27 -0400
Received: by lbgc1 with SMTP id c1so2341915lbg.29
        for <internals@lists.php.net>; Sat, 04 Aug 2012 13:03:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :cc:content-type;
        bh=mg9HlDG9qrzPCTc7oKV7XBYNVu3lWhtj4qlJ3i62gmk=;
        b=moM290wNW72Jkum6+lVk+YMnpbEN+gsz1MxJNsGO5UVZ9jCvqWaTArT7qyE/+sSbbj
         rYoCW0V5/meaLU7ZsJx6lJCQWCT3WC9WL7kcMKOnyD5NIR8Goh7NQfDieIc2QM6eLrm9
         Kb17HeWTYtXAA6ZX/lfm26GXeTsiEZPlr8uoX/ae+U7PfoToxriSi8YbqVtErke/R5Bl
         K1eVx+QHeXWqI7Ml7AsxkqZpDUN70PZgBoqjuNzhU3KAEK8mbEt0/EyWMLbD8qhNMPbs
         hVBC71nKe07WWTHupFXo2VeZlYOb7lBWV5cW2DSGbEQONQUO+pvXh2Hnfo7WfR3h7R8c
         qZGA==
MIME-Version: 1.0
Received: by 10.112.43.135 with SMTP id w7mr2462093lbl.48.1344110603594; Sat,
 04 Aug 2012 13:03:23 -0700 (PDT)
Received: by 10.152.114.70 with HTTP; Sat, 4 Aug 2012 13:03:23 -0700 (PDT)
In-Reply-To: <CANVTSm4pseLgp5RnD0Uh5aSvu3Zox6wwu65jDjikTeBXFyySDw@mail.gmail.com>
References: <CANVTSm4pseLgp5RnD0Uh5aSvu3Zox6wwu65jDjikTeBXFyySDw@mail.gmail.com>
Date: Sat, 4 Aug 2012 22:03:23 +0200
Message-ID: <CAF+90c97op9xjozgbcqhkDMDB3NxtiWJ0Ge3w9mW1yro+EEMSQ@mail.gmail.com>
To: Yahav Gindi Bar <g.b.yahav@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] Integrate PECL into PHP
From: nikita.ppv@gmail.com (Nikita Popov)

On Sat, Aug 4, 2012 at 9:57 PM, Yahav Gindi Bar <g.b.yahav@gmail.com> wrote:
> We had dl() until it was deprecated, and even when we got it I guess that
> administrators disabled the dl() method because of security reasons.
> However, PECL got limited extensions which, as long as I know, does not put
> the server into security risks (maybe I've said something VERY STUPID right
> now, so excuse me...)

PECL extensions are C code. "C code" is programmer slang for "security risk".

I mean, seriously, extension code can be pretty much everything.
Allowing people to load extensions from userland would go beyond
fatal.

Nikita