Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72576
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.178 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <52FD5CB5.7070206@lerdorf.com>
References: <CAGa2bXYU0+eVgnDCkqpG6AWvLCX9gV3+5nzoeD-RJge8Rtw-dQ@mail.gmail.com>
 <CAGa2bXZCBxJczqX6FKz0T0_iV9LzdeHkw46c17NQsanuCCJ9rA@mail.gmail.com>
 <52FBF8F8.5040107@gmail.com> <CAGa2bXb=2fJisj90HY6ojMKmJeFFGbTwn6J1vZayzxBTLz7fBQ@mail.gmail.com>
 <52FCDFBD.80901@lerdorf.com> <CAGa2bXb4Ry6rwaXzjfjfLDzyhb_vgehTKTmadeSHScUCYycEqg@mail.gmail.com>
 <52FD5CB5.7070206@lerdorf.com>
Date: Fri, 14 Feb 2014 10:01:35 +0900
Message-ID: <CAGa2bXb0ZOxzhxP5KPorW+Bw8jZtL9QB2XAzwmuBLvPJwjsdyg@mail.gmail.com>
To: Rasmus Lerdorf <rasmus@lerdorf.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c3c7f05a2ca104f2535b8a
Subject: Re: [PHP-DEV] Re: [RFC] No PHP tags
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c3c7f05a2ca104f2535b8a
Content-Type: text/plain; charset=UTF-8

Hi Rasmus,

On Fri, Feb 14, 2014 at 9:00 AM, Rasmus Lerdorf <rasmus@lerdorf.com> wrote:

> Striving to make PHP more secure for neophyte developers is always a
> worthy goal, but it needs to be done in a way that doesn't make things
> worse. I think this particular approach would make things worse by
> needlessly complicating things.
>

I agree that needless complexity should be avoided.
Switching template mode on and off is tricky, although existing codes can be
secured without many lines of change. There are options for LFI mitigation.
There might be convincing solution. I cannot think of one now, though.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c3c7f05a2ca104f2535b8a--