Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83863
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.45 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CALwr1Gk6OOMTRkmgxwqdd_cVDAQQRUkA5fqvLxOf4i2VOZxSig@mail.gmail.com>
References: <CAGa2bXbt9FAdRtW1GxDyT+G-4bWBACTso_DOizcSHmmgmSVtmA@mail.gmail.com>
	<CAGa2bXb5QEKOggRbUnmVHuib=P_tJ9_W+QyMa_SCpc7RmSCgSA@mail.gmail.com>
	<54EE50CF.9090508@gmail.com>
	<CALwr1GmoAxfbKvJYVLeL3wPXEKKbu1jKGkTFcG0KQ_Ogx172sA@mail.gmail.com>
	<54EE5A39.9040401@gmail.com>
	<CALwr1Gk6OOMTRkmgxwqdd_cVDAQQRUkA5fqvLxOf4i2VOZxSig@mail.gmail.com>
Date: Wed, 25 Feb 2015 17:51:48 -0800
Message-ID: <CAEZPtU4tzr6RBbPqBV4mg-sy0HpcXnqm4D8jQ2-q4Y0DNnMdFQ@mail.gmail.com>
To: =?UTF-8?Q?P=C3=A1draic_Brady?= <padraic.brady@gmail.com>
Cc: Stanislav Malyshev <smalyshev@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Re: [RFC][VOTE] Introduce script only include/require
From: pierre.php@gmail.com (Pierre Joye)

On Wed, Feb 25, 2015 at 4:40 PM, P=C3=A1draic Brady <padraic.brady@gmail.co=
m> wrote:
> Stanislav,
>
> On 25 February 2015 at 23:26, Stanislav Malyshev <smalyshev@gmail.com> wr=
ote:
>> else I can say, provided that what I already said - including
>> demonstrating trivial workarounds that allow to circumvent this feature
>> with extreme ease - had no effect.
>
> You keep bringing that up. I keep having to correct you that the RFC
> does not target your specific example (it's a simple file extension
> filter). Then, you bring it up again...continuing to ignore the
> examples provided where it could assist in preventing the whole jpeg
> EXIF mess in the wild.

I think it won't even prevent that to happen. But this is another long
story to explain why.

I also voted no for pretty much the same root reasons, it is a fake
sense of security. Yes, it may help some basic cases, reducing the
surface of attack but that's all about it. This is why I see it as
another safemode or magic quotes, not from a feature point of view,
but how it tries to solve an actual problem using a very partial and
weak solution. I am also not very interested to enter the debate again
but to state why I voted no. I admire Yasuo in his constant effort to
improve PHP security from an end user point of view and I sadly
disagree with the solution he provides with this RFC.

Cheers,
Pierre