Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69402
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.49 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGbiJu_S4JeeOwMRCNbCyOToT5WPvkJPGjGBg8_Wb4g7Pn2MqQ@mail.gmail.com>
References: <CAGa2bXbh6dOf41nZ0r-RuRtkCuuiA=r=SnxS+A1+GgqFXPGOWQ@mail.gmail.com>
 <CABBJUpdNr6McK6Q4qtztiYYG9CKZF7AeUdvo3YM+W0S87f8nDg@mail.gmail.com>
 <CAPwsocEwM_A3YraxZmJEXjBxaGgTZhfv711801bwtHLfJfNh+Q@mail.gmail.com>
 <CAHMUw2EQuT-y2Ho85QXhDdtysTWC=4FyY4nK9i-yR7qGqk6M=Q@mail.gmail.com>
 <CAPwsocGh-e1xAmvxgBF6St++9TBdW6uzRy8Xu4Jhb4p-N4vFvQ@mail.gmail.com>
 <CAGa2bXaH7B3vO=4Ap2hTfwUEp4Sw-PoK-omK6r=O71OUNksDxg@mail.gmail.com> <CAGbiJu_S4JeeOwMRCNbCyOToT5WPvkJPGjGBg8_Wb4g7Pn2MqQ@mail.gmail.com>
Date: Sat, 28 Sep 2013 11:39:39 +0200
Message-ID: <CAEU6NAen29mfS1kNA+jdRy9FZCqwM__N_Z+Exk8sjGjUM4UHxg@mail.gmail.com>
To: Madara Uchiha <madara@tchizik.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, Leigh <leight@gmail.com>, 
	Tjerk Meesters <tjerk.meesters@gmail.com>, PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c34854fb94f804e76e6296
Subject: Re: [PHP-DEV] Regenerating session ID automatically when IP address
 has changed
From: peter.e.lind@gmail.com (Peter Lind)

--001a11c34854fb94f804e76e6296
Content-Type: text/plain; charset=UTF-8

On 28 September 2013 11:27, Madara Uchiha <madara@tchizik.com> wrote:

> You guys are missing the point. This isn't a language level issue. I
> can imagine some sort of package or a library being made, some sort of
> wrapper around the current session commands, perhaps integrated into
> some sort of extension.
>
> But it is NOT a language level issue. This isn't a problem the
> language needs to solve, ESPECIALLY since userland implementation is
> so trivial.
>

I would disagree. PHP has very low security levels by default and some WTF
security issues because of default settings. It should be the other way
round: high security by default that you need to actively change if you
want it lowered.

The problem is that the majority of PHP developers for better or worse
think they can copypaste solutions to problems and forget about things
after that as long as the output on their screens look ok. For many
developers, security is an afterthought if even that. And you are, quite
simply, NOT GOING TO CHANGE THAT IN THE FORESEEABLE FUTURE.

It's not a question of whether you're right or wrong in principle - it's a
simple question of statistics. You will have close to zero impact on the
PHP developers, no matter how many blog articles you write. It is too large
and too diverse a group.

So you're stuck with two choices: accept that PHP security is lax and that
as a result a lot of code will have many attack vectors, or try to change
the language itself for the better. The third option of "educate" is a
mirage.

Note: I'm not saying this feature would be an overall benefit for the
security of PHP, but the reasoning behind it is right.

Regards
Peter

-- 
<hype>
WWW: plphp.dk / plind.dk
CV: careers.stackoverflow.com/peterlind
LinkedIn: plind
Twitter: kafe15
</hype>

--001a11c34854fb94f804e76e6296--