Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:66387
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.47 as permitted sender)
Content-Type: multipart/alternative; boundary="Apple-Mail=_CA731B4B-FC35-48BA-9BFF-9708D1A0E512"
Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\))
In-Reply-To: <CAAyV7nGodN0OKUTGY0RQ_P_Za3igkZPXjm1D8r8EUsyZ5XrYeg@mail.gmail.com>
Date: Fri, 1 Mar 2013 21:39:16 +1100
Cc: "internals@lists.php.net" <internals@lists.php.net>
Message-ID: <84542299-5560-453A-B9A6-430FFCDF74EA@gmail.com>
References: <CAAyV7nGodN0OKUTGY0RQ_P_Za3igkZPXjm1D8r8EUsyZ5XrYeg@mail.gmail.com>
To: Anthony Ferrara <ircmaxell@gmail.com>
Subject: Re: [PHP-DEV] Include XDebug and Suhosin Patch in Core for 5.5
From: davidkmuir@gmail.com (David Muir)

--Apple-Mail=_CA731B4B-FC35-48BA-9BFF-9708D1A0E512
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=iso-8859-1


On 01/03/2013, at 7:00 AM, Anthony Ferrara <ircmaxell@gmail.com> wrote:

> Hey all,
>=20
> Based off of the recent discussion around pulling in ZO+ into core, =
I've
> come to the conclusion that we should also pull in XDebug and Suhosin =
into
> core at the same time.
>=20
> 1. It has integration issues with ZO+ in that it has to be included in =
a
> specific order (specifically around ini declarations). If it was =
included
> into core, this could be accounted for allowing for more robust =
behavior.
>=20
> 2. Both to be maintained for each new language feature as well as
> opcode-caches. This will have the same benefit as integrating ZO+, as =
it
> can be maintained inline with the engine.
>=20
> 3. Both stand as a barrier to adoption as many will not run PHP in
> development without XDebug, and they won't run it in production =
without the
> Suhosin patch.
>=20
> Since both of these are vital to PHP's uptake and adoption of new =
versions,
> I feel it's important to delay 5.5 until we can get both in. I can =
draft up
> the RFC if necessary...
>=20
> Anthony


Nice :-P=20

Seriously though, what's the deal with the Suhosin patch? I use it =
because it's included by default on Ubuntu... Didn't know about the huge =
performance impact. Their website seems to imply that PHP has security =
holes that have never been patched, and are only closed by using =
Suhosin. I find that hard to believe. Is PHP really *that* vulnerable =
without it? The site (http://www.hardened-php.net/suhosin/) is somewhat =
light on details.

Cheers,
David


--Apple-Mail=_CA731B4B-FC35-48BA-9BFF-9708D1A0E512--