Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:73321
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.176 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXb74KKizUbN_CuEVJwOFDUBUBYe_6deWLk1A9CBhGHZbg@mail.gmail.com>
References: <CAGa2bXYJqGqegGy=rYcDBXd8RmFFR9j=p2m63ZVSADoga+vwhg@mail.gmail.com>
	<5329E37C.5000106@sugarcrm.com>
	<CAGa2bXaDA=EhqgxZLqkBjTJqPyeogma1oC8L8NiTKx3WKp-rUg@mail.gmail.com>
	<532A43C5.309@sugarcrm.com>
	<CAGa2bXb74KKizUbN_CuEVJwOFDUBUBYe_6deWLk1A9CBhGHZbg@mail.gmail.com>
Date: Thu, 20 Mar 2014 05:02:40 +0100
Message-ID: <CAEZPtU4TaWSxnYqvceVKPgZJivheRK_M3ynpvasnh+a6+1ps0w@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Stas Malyshev <smalyshev@sugarcrm.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC] [Discussion] Secure session_regenerate_id()
From: pierre.php@gmail.com (Pierre Joye)

hi Yasuo,

I really appreciate your constant effort to improve security and php
in general. In the case of the session management I am not sure I can
vote positively on the current RFC(s).

On Thu, Mar 20, 2014 at 4:07 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi Stas,
>
> On Thu, Mar 20, 2014 at 10:26 AM, Stas Malyshev <smalyshev@sugarcrm.com>wrote:
>
>> > I'm recognizing reliability/availability as a part of security.
>> > ISO 27000 defines it's a part of security.
>>
>> Let's not parse semantics here. Declaring something that is not security
>> issue - i.e. would not lead to unauthorized access, data disclosure,
>> etc. - as security issue only makes real security issues drown in the
>> noise and not get proper priority. And mislead people into thinking that
>> existing ways - which are fine - are somehow insecure and make them not
>> use them.
>>
>
> I'm OK with different name.
> Lines between security issue or not is vague.

I agree with Stas here. I have been asking for past CVEs related to
the possible issues you described here, I did not find any and sadly
did not get any information which could change my mind.

Most of what is described here should be covered by the application
layer as it really depends on what developers need. Per se, the
current session module is safe. It may not cover all edges cases but
this is why we have the necessary API to allow developers to add
behaviors, as desired (not necessary required, which is the point I
agree with Stas here).

Cheers,
-- 
Pierre

@pierrejoye | http://www.libgd.org