Re: Re: Announcement: Releasing CORE GRASP for PHP. An open source, dynamic web application protection system.

> I thing a good FAQ entry would be how this patch fits in with Suhosin > and what are the comparable/conflicting concepts, are they compatible > with each other etc. > > http://www.hardened-php.net/suhosin/a_feature_list.html > > > Both systems are liable to appeal to the same sort of people so it makes > sense to cover this. What I do not understand is why don't these patches get put instantly back into the core PHP distribution? So patches against 5.2.3 perhaps would be in 5.2.4, etc? IMHO there shouldn't be a hardened PHP project. Their patches should be put in whenever possible, perhaps during an RCx before a gold build or something. Any loss of functionality due to them should be a configuration option to turn on/off but otherwise everyone would benefit from security, memory leak, and other patches... - mike