Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:70859
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.178 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <52B81559.8080409@php.net>
References: <3014595E-B155-47F6-AC7B-71083D89525D@rouvenwessling.de>
 <52B80C5B.2050208@sugarcrm.com> <6C0AE2F4-26DA-4081-914A-F6D18C46911C@rouvenwessling.de>
 <52B81559.8080409@php.net>
Date: Mon, 23 Dec 2013 12:04:10 +0100
Message-ID: <CADyq6sJESC+UG_Vb7Wq=nHQWF0-5zL=7Yzpi2L8rr4CQwyr5ug@mail.gmail.com>
To: Joe Watkins <krakjoe@php.net>
Cc: PHP Internals List <internals@lists.php.net>, =?UTF-8?Q?Rouven_We=C3=9Fling?= <me@rouvenwessling.de>
Content-Type: multipart/alternative; boundary=089e0149cf809ca9d304ee319719
Subject: Re: [PHP-DEV] [RFC] Timing attack safe string comparison function
From: ocramius@gmail.com (Marco Pivetta)

--089e0149cf809ca9d304ee319719
Content-Type: text/plain; charset=UTF-8

Heya,

I was discussing about this RFC with Joe in Room 11 (where we keep him away
from society, for the greater good).

I was wondering why such an API must be implemented in PHP core (which
means C, which means that the usual 15~20 people can fix it if borked,
which is bad) and cannot be just left in userland as it already happens,
for example, with
https://github.com/zendframework/zf2/blob/master/library/Zend/Crypt/Utils.php#L17-L44and
similar libraries that have some decent security policies themselves
(nothing to say about PHP - you guys are doing great!).

Why do we need this in core?
Why can't a user copy-paste those rows (if it's a monkey-patcher) or just
use a library?

I don't trust PHP coders in general, so I'm pretty sure that the example
I've posted before @ https://gist.github.com/Ocramius/8094168 is quite
obscure to the 99.9% of PHP developers.

Who has been doing it wrong will continue going on and not caring.

Those who are aware of the dangers and do care are most probably already
using these kinds of checks vie an imported library.

So what is pushing towards yet another function in here?

Don't get me wrong: I am all for security, but I don't see a difference
between a php-core implementation and a userland implementation.

Cheers,



Marco Pivetta

http://twitter.com/Ocramius

http://ocramius.github.com/

--089e0149cf809ca9d304ee319719--