Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72161
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.177 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <94915413.20140203185646@cypressintegrated.com>
References: <CAH8Mpn=Kw9CCmpiXm-UE2s=GKFroTGczTr=ENczuAeiTCH6QwQ@mail.gmail.com>
	<344075933.20140203143339@figureone.com>
	<CAH8MpnkuFDNzYi4enqqtQcmis08LyTWojV3DZrc_Mwim=aqvRQ@mail.gmail.com>
	<CAH8MpnnXag49Yw9yE2p=+h3X2caz6wwfiT8kLf8H_WxrwtjVNw@mail.gmail.com>
	<10337340.20140203171726@cypressintegrated.com>
	<CALwr1Gmy2amRoWPpfmY41LJboAqnJp0pFcgYN0owwuAy_6fP4g@mail.gmail.com>
	<94915413.20140203185646@cypressintegrated.com>
Date: Tue, 4 Feb 2014 00:29:29 +0000
Message-ID: <CALwr1GmVApG8-xQ-8pbiO0mm8oWM=pvNVjxSveFuvbnf-UuZJg@mail.gmail.com>
To: Sanford Whiteman <swhitemanlistens-software@cypressintegrated.com>
Cc: =?UTF-8?Q?P=C3=A1draic_Brady?= <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Re: Windows Peer Verification
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Hi,

On 3 February 2014 23:56, Sanford Whiteman
<swhitemanlistens-software@cypressintegrated.com> wrote:
>> I'm sorry, but this is simply outrageous. It is a programmer's
>> responsibility to code securely. It's not absurd, it's reality. If
>> you can't program securely, you shouldn't be programming.
>
> No, the reality is that (most) PHP users (most of whom are consuming
> someone else's code to some degree) assume that making an SSL
> connection means "secure."
>
> It is absurd to claim otherwise. In fact, _we are agreeing that that
> assumption should always have been correct_ by changing the default
> behavior in PHP!
>
> How can you possibly "blame" users and "fix" the behavior at the same
> time?

Hello. I am a programmer. Sorry, but oopsie, that script I wrote to
retrieve client data from our remote office? Well, I sort of forgot to
configure SSL correctly and, well, somebody dumped a whole list of
client names, emails, social security numbers and other personally
identifiable information onto a file dump site. I'm really really
sorry. It's all PHP's fault.

FIRED! FIRED! FIRED! :P

I blame programmers for security problems because it's their fault.
Anyone who can't take personal responsibility needs to grow up and own
up. Programmers aren't, at least in a professional capacity, children
anymore. This whole attitude of avoiding responsibility by pointing
fingers at anything else is the one thing that drives security people
demented.

>> Your blaming of PHP is significantly misplaced.
>
> No, it is not.

We'll have to agree to disagree about who gets blamed when hackers strike.

> If it were, this patch would not exist, for it has ALWAYS been
> possible to create a peer-verified outbound connection from PHP.
>
> You cannot at once place blame only on the developer and make a core
> change so the language is "the way it should always have been."

You missed the cURL part of my last email, I presume...

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com
Zend Framework Community Review Team
Zend Framework PHP-FIG Representative