Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69404
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.172 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAEU6NAen29mfS1kNA+jdRy9FZCqwM__N_Z+Exk8sjGjUM4UHxg@mail.gmail.com>
References: <CAGa2bXbh6dOf41nZ0r-RuRtkCuuiA=r=SnxS+A1+GgqFXPGOWQ@mail.gmail.com>
	<CABBJUpdNr6McK6Q4qtztiYYG9CKZF7AeUdvo3YM+W0S87f8nDg@mail.gmail.com>
	<CAPwsocEwM_A3YraxZmJEXjBxaGgTZhfv711801bwtHLfJfNh+Q@mail.gmail.com>
	<CAHMUw2EQuT-y2Ho85QXhDdtysTWC=4FyY4nK9i-yR7qGqk6M=Q@mail.gmail.com>
	<CAPwsocGh-e1xAmvxgBF6St++9TBdW6uzRy8Xu4Jhb4p-N4vFvQ@mail.gmail.com>
	<CAGa2bXaH7B3vO=4Ap2hTfwUEp4Sw-PoK-omK6r=O71OUNksDxg@mail.gmail.com>
	<CAGbiJu_S4JeeOwMRCNbCyOToT5WPvkJPGjGBg8_Wb4g7Pn2MqQ@mail.gmail.com>
	<CAEU6NAen29mfS1kNA+jdRy9FZCqwM__N_Z+Exk8sjGjUM4UHxg@mail.gmail.com>
Date: Sat, 28 Sep 2013 11:25:14 +0100
Message-ID: <CAPwsocG_aKa7gCFhE3naVksN2FJTfsQU8pM4hqBkMA6KRfJzZA@mail.gmail.com>
To: Peter Lind <peter.e.lind@gmail.com>
Cc: PHP Internals <internals@lists.php.net>, Yasuo Ohgaki <yohgaki@ohgaki.net>, 
	Tjerk Meesters <tjerk.meesters@gmail.com>, Madara Uchiha <madara@tchizik.com>
Content-Type: multipart/alternative; boundary=001a11c262cec6201604e76f0422
Subject: Re: [PHP-DEV] Regenerating session ID automatically when IP address
 has changed
From: leight@gmail.com (Leigh)

--001a11c262cec6201604e76f0422
Content-Type: text/plain; charset=ISO-8859-1

On Sep 28, 2013 10:39 AM, "Peter Lind" <peter.e.lind@gmail.com> wrote:
>
> So you're stuck with two choices: accept that PHP security is lax and
that as a result a lot of code will have many attack vectors, or try to
change the language itself for the better. The third option of "educate" is
a mirage.
>

PHP provides you with all the tools you need to write secure apps. I could
go around writing mysql_query($_REQUEST["blah"]) but I don't. Why? Because
I have been educated. We don't have restrictions in the core that prevent
me from doing it, and we don't need them either.

I agree with you, being secure by default is a worthy objective, but the
proposal here shouldn't even be on by default. (remember not everyone is
able to control their ini settings and whatnot)

Education is not a mirage. People picked up their insecure coding habits
from somewhere, and if its from laziness then I don't think they really
deserve protecting. If it was from a terrible blog article promoting
insecure practices then we need better articles. There's not much we can do
to remove the content that's already out there, but there's a lot we can do
with providing new, up to date and accurate content.

--001a11c262cec6201604e76f0422--