# FFI & Security

- Thread: https://externals.io/message/107534
- Original archive: https://news-web.php.net/php.internals/107534
- Started by Joe Watkins on 2019-10-14T07:44:59+00:00
- Messages: 4
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #107534 — Joe Watkins — 2019-10-14T07:44:59+00:00

URL: https://externals.io/message/107534#107534

Morning all,

Recently we voted on classification criteria for security bugs [1], we
include under "not an issue" any issue that "requires invocation of
specific code, which may be valid but is obviously malicious".

I would like to add an explicit clause under the "not an issue" section for
anything related to FFI.

It hardly seems worth it to run an RFC, although I'll be happy too if there
is a single dissenting voice.

If there are no objections, I'll modify the document 7 days from today
(Monday 21st October).

Cheers
Joe

[1] https://wiki.php.net/security

---

## #107535 — Stanislav Malyshev — 2019-10-14T07:47:31+00:00

URL: https://externals.io/message/107534#107535 · In reply to: #107534

Hi!

> Recently we voted on classification criteria for security bugs [1], we
> include under "not an issue" any issue that "requires invocation of
> specific code, which may be valid but is obviously malicious".
> 
> I would like to add an explicit clause under the "not an issue" section for
> anything related to FFI.

I agree, most of the issues with regard to FFI would not qualify as
security issues, and we may as well state that explicitly.


-- 
Stas Malyshev
smalyshev@gmail.com

---

## #107732 — Christoph M. Becker — 2019-10-30T11:41:31+00:00

URL: https://externals.io/message/107534#107732 · In reply to: #107534

> Recently we voted on classification criteria for security bugs [1], we
> include under "not an issue" any issue that "requires invocation of
> specific code, which may be valid but is obviously malicious".
>
> I would like to add an explicit clause under the "not an issue" section for
> anything related to FFI.
>
> It hardly seems worth it to run an RFC, although I'll be happy too if there
> is a single dissenting voice.
>
> If there are no objections, I'll modify the document 7 days from today
> (Monday 21st October).
>
> Cheers
> Joe
>
> [1] https://wiki.php.net/security

What is the status here?  It seems the security classification document
has not yet been updated.

Cheers,
Christoph

---

## #107760 — Joe Watkins — 2019-11-04T08:33:00+00:00

URL: https://externals.io/message/107534#107760 · In reply to: #107732

Morning internals,

Sorry about the delay, this has now been updated.

> There was an unexpected problem communicating with SMTP: Unexpected
return code - Expected: 250, Got: 451 | 451 4.3.0 Error: queue file write
error

Because infrastructure ...

Cheers
Joe



> 
>
> > […]
> for
> > […]
> there
> > […]
>
> What is the status here?  It seems the security classification document
> has not yet been updated.
>
> Cheers,
> Christoph