Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:81894
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.173 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAEZPtU5=vJG6=cguZfcT6RBriu8GT9vfW=Lqva8-XfEnXzZ23Q@mail.gmail.com>
References: <CAGa2bXZMxxXBOQ=NdbNtzgrjjvdomV8zOr+Z4zASZU4+JHmqyw@mail.gmail.com>
	<CAGa2bXbf=hzbZ9eH6JVnMM0+6OeTQvAoqBe44g8qxFAAr9u9Kw@mail.gmail.com>
	<CAG1choq8S_EkdS22SFO+443u_LYVB-Z-b2ra6RK8sDhrJKc-VQ@mail.gmail.com>
	<CAGa2bXbJyK=2GCmGDw7PAh0ib=EL9GO7FFGf0X6VyAWqfR8EAA@mail.gmail.com>
	<CADajX4CHHdSpUfLfjhwrtdzmJfg9di4FpfeVEzBG4P7K7B+e0w@mail.gmail.com>
	<CAPwsocGh_-SYiWceEg=5go8G1bUs+CWUBb9uv_2Oh7AZhBxd8A@mail.gmail.com>
	<CAGa2bXY36wVN50sQ=MTYi+X6664+NYqMhsYFVZ9jeFZ1DXBg9Q@mail.gmail.com>
	<CAEZPtU5=vJG6=cguZfcT6RBriu8GT9vfW=Lqva8-XfEnXzZ23Q@mail.gmail.com>
Date: Thu, 5 Feb 2015 10:51:42 +0000
Message-ID: <CAPwsocFF0TJQ2UAiniiQQrk6VaUQdZcKOJAbaoaAA-38fDSS8w@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, Pierre Joye <pierre.php@gmail.com>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Re: [RFC][DISCUSSION] script() and script_once()
From: leight@gmail.com (Leigh)

On 5 February 2015 at 10:24, Pierre Joye <pierre.php@gmail.com> wrote:
> I do understand what you try to achieve, from all point of view.
> However I strongly disagree with this as a security improvement. I see
> this more as yet another attempt to replace what should be done at the
> OS level.
>

I'm inclined to agree, this is just another mitigation against a
specific vector, not a solution. I'm sure given a little bit of time a
way to bypass it will be found.

Also introducing this in PHP 7 will not fix all of the currently
broken apps, nor will it get people to start using this method even if
they do upgrade to PHP 7.

I honestly think this is one of the cases where education is better .