Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:66388
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.177 as permitted sender)
MIME-Version: 1.0
Sender: julienpauli@gmail.com
In-Reply-To: <84542299-5560-453A-B9A6-430FFCDF74EA@gmail.com>
References: <CAAyV7nGodN0OKUTGY0RQ_P_Za3igkZPXjm1D8r8EUsyZ5XrYeg@mail.gmail.com>
 <84542299-5560-453A-B9A6-430FFCDF74EA@gmail.com>
Date: Fri, 1 Mar 2013 12:01:26 +0100
Message-ID: <CAMUwpuQY3tHhJCR2OpKy-MnovzSkyKNvo3uLOx=AB3xBW=yMZw@mail.gmail.com>
To: David Muir <davidkmuir@gmail.com>
Cc: Anthony Ferrara <ircmaxell@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=20cf307f3aa41ab1f004d6daf06b
Subject: Re: [PHP-DEV] Include XDebug and Suhosin Patch in Core for 5.5
From: jpauli@php.net (Julien Pauli)

--20cf307f3aa41ab1f004d6daf06b
Content-Type: text/plain; charset=ISO-8859-1

On Fri, Mar 1, 2013 at 11:39 AM, David Muir <davidkmuir@gmail.com> wrote:

>
> On 01/03/2013, at 7:00 AM, Anthony Ferrara <ircmaxell@gmail.com> wrote:
>
> > Hey all,
> >
> > Based off of the recent discussion around pulling in ZO+ into core, I've
> > come to the conclusion that we should also pull in XDebug and Suhosin
> into
> > core at the same time.
> >
> > 1. It has integration issues with ZO+ in that it has to be included in a
> > specific order (specifically around ini declarations). If it was included
> > into core, this could be accounted for allowing for more robust behavior.
> >
> > 2. Both to be maintained for each new language feature as well as
> > opcode-caches. This will have the same benefit as integrating ZO+, as it
> > can be maintained inline with the engine.
> >
> > 3. Both stand as a barrier to adoption as many will not run PHP in
> > development without XDebug, and they won't run it in production without
> the
> > Suhosin patch.
> >
> > Since both of these are vital to PHP's uptake and adoption of new
> versions,
> > I feel it's important to delay 5.5 until we can get both in. I can draft
> up
> > the RFC if necessary...
> >
> > Anthony
>
>
> Nice :-P
>
> Seriously though, what's the deal with the Suhosin patch? I use it because
> it's included by default on Ubuntu... Didn't know about the huge
> performance impact. Their website seems to imply that PHP has security
> holes that have never been patched, and are only closed by using Suhosin. I
> find that hard to believe. Is PHP really *that* vulnerable without it? The
> site (http://www.hardened-php.net/suhosin/) is somewhat light on details.
>

Any computer system is vulnerable as far as you press the start button and
plug in the network cable ;-)

Julien

--20cf307f3aa41ab1f004d6daf06b--