Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72411
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.173 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <52F65FCD.4060403@lsces.co.uk>
References: <52F61A78.1020401@lsces.co.uk>
	<CAF+90c9ZmeysC88ghHk50rpv_8T4jYhGCWEDwZxOR5EmPuDDLg@mail.gmail.com>
	<52F62B08.6050201@ajf.me>
	<52F63DDE.6090600@lsces.co.uk>
	<CAEZPtU5-DnNeFFJDGYG+YHjL_SOddNeiqcoJp_Ye2G+Lgdu2ow@mail.gmail.com>
	<52F657E4.4030603@cubiclesoft.com>
	<CALwr1GmBo6MswwMFABP-+X=eMCAke5DBv+d77D2y+d0BmxCT2g@mail.gmail.com>
	<52F65FCD.4060403@lsces.co.uk>
Date: Sat, 8 Feb 2014 17:23:21 +0000
Message-ID: <CALwr1G=M=vzJfTmCmQ5VjQfrZr7HVFjfVr+Y5twwUyvRurNcTg@mail.gmail.com>
To: Lester Caine <lester@lsces.co.uk>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Security Diligence
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Hi,

On 8 February 2014 16:48, Lester Caine <lester@lsces.co.uk> wrote:
> P=C3=A1draic Brady wrote:
>>
>> The RFCs do imply some awareness of
>> security and that's largely unavoidable unless each and every RFC
>> needs to be a 1000 page masterwork;).
>
>
> Since 'security experts' tend not to wait for fixes to be produced before
> publishing exploits all I am looking for in this case is enough help in t=
he
> rfc's to assess if action is required before fixes ARE published!

Good security people will always await fixes before publishing
publicly so long as the wait is not unreasonable for the target sample
of cases. That's the tendency unless you have data to the contrary?
I'm pretty sure those references I provided earlier point at the
researchers in each case reporting to open source projects prior to
publishing their research. Obviously, researchers can't report to
every single open and closed source library and app that exists but
they do make a best effort to get the word out.

> And I hope that since these are security fixes that they are pushed back =
as
> far as PHP5.3 since this is still under support for security fixes? It is
> even more important if the fixes are not being rolled back that the exten=
t
> of the risk is recorded well enough for users to understand the risk?

These are not vulnerabilities within PHP but in userland code. The
RFCs will make it easier for userland code to be secure out of the
box, but userland code should already have such issues patched. I
don't see any reason to backport the RFCs unnecessarily - you can make
arguments for adding anything useful to older versions not just for
security.

Paddy

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com
Zend Framework Community Review Team
Zend Framework PHP-FIG Representative