Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:70037
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.175 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CADajX4AXOnOUX2DHf4D7+tTKUNHsCyP2WUz3KkKkxuvChpBKrg@mail.gmail.com>
References: <60B9BBE0-BC3F-490A-AD78-9EBC22C808CF@googlemail.com>
 <CAGa2bXZ1XVf0HZ4oQ8r0gsaw6UmxuQfEquVMcTZjk5wfPwqcGQ@mail.gmail.com> <CADajX4AXOnOUX2DHf4D7+tTKUNHsCyP2WUz3KkKkxuvChpBKrg@mail.gmail.com>
Date: Thu, 7 Nov 2013 05:00:08 +0900
Message-ID: <CAGa2bXZBuXXyUc=1zEiw=-CtE82DHYhc+C8m_w5Z4ubw-U6oxg@mail.gmail.com>
To: Adam Harvey <aharvey@php.net>
Cc: Kevin Ingwersen <ingwie2000@googlemail.com>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1135e1f6ff989c04ea879aa6
Subject: Re: [PHP-DEV] CLI Web Server customization
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a1135e1f6ff989c04ea879aa6
Content-Type: text/plain; charset=UTF-8

Hi Adam,

On Thu, Nov 7, 2013 at 1:45 AM, Adam Harvey <aharvey@php.net> wrote:

> My recollection of the discussion at the time was that part of the
> reasoning behind that note was security: the CLI server was a new
> piece of code, and the public Internet is a pretty hostile place,
> particularly for Web servers. Therefore the intention was to
> discourage users from exposing the CLI server on anything other than
> loopback and private networks.
>
> It doesn't sound like that's a problem for Kevin, but I'm pretty sure
> that was part of the context there.
>

I agree.

There was security issue in cli server in fact.
Current documentation is too much. IMHO.
It may be good time to modify our doc a little.

Any objection for making security warning to a note
that discourages use under internet?

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a1135e1f6ff989c04ea879aa6--