Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94581
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.218.48 as permitted sender)
MIME-Version: 1.0
Reply-To: bishop@php.net
Sender: bishop.bettini@gmail.com
In-Reply-To: <CAGa2bXYkfG4o-gUTGohpkdQ3VWn_5B7u_avTX3raHX=XxZ+vBw@mail.gmail.com>
References: <CAGa2bXbZgGe3aq--SZ3D3AC1bYX7mTctDC-6CUy--X+UZ9XEiQ@mail.gmail.com>
 <CAGa2bXYkfG4o-gUTGohpkdQ3VWn_5B7u_avTX3raHX=XxZ+vBw@mail.gmail.com>
Date: Tue, 19 Jul 2016 20:47:55 -0400
Message-ID: <CAEYWF=4NQ3w-VWeqF89LTpFaqA1wvf7ctnwHsVRcFy+p1cP-tA@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113e237a1442dc0538068fa6
Subject: Re: [PHP-DEV] Re: [RFC][VOTE] Enable session.use_strict_mode by default
From: bishop@php.net (Bishop Bettini)

--001a113e237a1442dc0538068fa6
Content-Type: text/plain; charset=UTF-8

On Mon, Jul 18, 2016 at 9:40 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
> On Tue, Jul 12, 2016 at 10:01 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> > Vote for "Enable session.use_strict_mode by default" RFC has started.
> >
> > https://wiki.php.net/rfc/session-use-strict-mode
> >
> > Vote ends 2017/07/19 UTC.
> >
>
> Thank you for voting!
>
> Vote is finish 4 vs 4. The RFC is declined.
> I'll improve the manual so that attackers would not enjoy stealing PHP
> web app accounts.
>
> Besides documentation, we must improve the way it is now. i.e. Do not
> let attackers steal accounts easily with default configuration.
>
> To decide next move, I would like to start hearing the reason why from
> those who are against this RFC.
>

I abstained from voting. While I would be a "Yes" in principle, two
specific statements in the RFC made me wary of following that instinct:

1. "external session data storage may have noticeable impact"
2. "lost sessions are far better than stolen sessions"

I can hand waive the first one away, as performance can be optimized
usually. But I can't really agree that, in general, lost sessions are "far
better" than stolen ones: if lost sessions happen 1% of the time, and
stolen sessions happen .001% of the time, then to me lost sessions are
worse.

--001a113e237a1442dc0538068fa6--