Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69235
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain adamharvey.name designates 209.85.223.181 as permitted sender)
MIME-Version: 1.0
Sender: adam@adamharvey.name
In-Reply-To: <CAH8MpnkX1p66AxeDXYaDiNaPBL635gKLXmS6qN=veB4H4CTicw@mail.gmail.com>
References: <CAH8MpnnTGD0xAwG1j9sh10EC6XzdscVRLbJzEMG6qWSBK5c17w@mail.gmail.com>
 <523A466C.4070903@gmail.com> <CAHMUw2HxcWgOBxiK=r4y6FgWF_Gkhgc6BgHxF_bgLLJG9RVxmQ@mail.gmail.com>
 <CAEZPtU7YjNksHLEyH9VzM-iDdpQmBeJkF-BHPkAajZjiQS5XBA@mail.gmail.com>
 <CAHMUw2Gv=JdswmWVHCvp2S3WECVPEx4aWOQzF2yLMHaqJ5HK-g@mail.gmail.com>
 <000001ceb53c$492a3090$db7e91b0$@org> <CAH8MpnkX1p66AxeDXYaDiNaPBL635gKLXmS6qN=veB4H4CTicw@mail.gmail.com>
Date: Thu, 19 Sep 2013 14:41:18 -0700
Message-ID: <CADajX4BudWBoKwZ8Xo5_QENQifdH2V3MDXe3vGszWkPAbwgjZw@mail.gmail.com>
To: Daniel Lowrey <rdlowrey@gmail.com>
Cc: "Bryan C. Geraghty" <bryan@ravensight.org>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Re: Re: PHP Crypt functions - security audit
From: aharvey@php.net (Adam Harvey)

On 19 September 2013 10:52, Daniel Lowrey <rdlowrey@gmail.com> wrote:
>> *I consider this a bug* I understand that it's easier to code not verify=
ing the
>> peer, and the hostname may not be available when you are stacking ssl ov=
er a stream.
>> But file_get_contents("https://...") is *precisely* the case that should=
 work right
>> out of the box.
>
> ^^ This.
>
> Before I can fully/cleanly implement these changes we need to decide
> if PHP wants to move to a secure-by-default model for streams
> utilizing the built in encryption wrappers. Thoughts?

I think we should do this in 5.6. cURL has behaved this way for
literally years at this point (verify by default, provide a switch to
disable verification) and users seem to do just fine there. The much
improved security story outweighs the (admittedly present) BC issues
for mine.

As for the CA bundle side of things, I wonder if this is one of those
rare times where an ini setting might make sense, as opposed to actual
bundling =E2=80=94 that would allow distros to point to their packaged bund=
les
without needing to patch php-src, and we could provide from-source
installation instructions easily enough to point to common distro
locations and the cURL download for users on more exotic OSes (like
Windows).

Adam