Re: PHP Security Advisory: Vulnerability in PHP versions 4.2.0 and 4.2.1

Greg, Your attitude stinks. PHP is a FREE scripting language. Think about the amount of money you are probably charging hosting clients, or charging in web or programming services, or making in site revenue, or whatever way you 'commercially function' through PHP. The register globals 'imposition' IS more secure and encourages better coding practices... would you prefer they made the change now, or in 5 years when you have 100's more sites to fix. Better late than later. If you want something that will never have a bug, never have a security hole, performs perfectly from day 1, never has an upgrade/change, and will never change for the better, you are utterly dreaming! The difference in this case is that the PHP Group aren't emptying your wallet. Sorry to hear that you'll have to do some more upgrading, but I'd keep the complaining to yourself -- "you get what you pay for" springs to mind, but in the case of PHP, we get a whole lot more. Justin French on 23/07/02 2:55 AM, Greg Donald (greg@destiney.com) wrote: > Not only did I get to re-write all my apps the past few months because of > the new register_globals default that was imposed by the php > group... > > Now I get to upgrade my PHP install once a month or so cause of new > security holes.. Yay! > > Wasn't this new register_globals setting supposed to enhance security? > > How would you like to be a sys admin with dozens of machines to upgrade > before you can proceed with anythign else? > > Can anyone say Ruby? >