Re: allow_url_fopen should be INI_ALL
| From: | Russell Nelson | Date: | Thu, 30 Jun 2005 00:05:47 +0000 |
| Subject: | Re: allow_url_fopen should be INI_ALL | ||
| References: | 1 2 3 4 5 6 7 8 9 10 11 12 13 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-17022@lists.php.net to get a copy of this message | ||
Rasmus Lerdorf writes:
> Forget your Google searches and go look at actual vulnerability reports
> for the last 3 months.
Vulnerability reports are not a reasonable statistical sample. They
aren't random. Also, people who report vulnerabilities are likely to
stop reporting them if the maintainers of the software make it clear
that the vulnerability won't get fixed. Why waste your time reporting
an 'include' break-in? After all, it's not a vulnerability -- many
people have told me that already.
For example, I didn't report the two include vulnerabilities I found.
Why should I? What problem would be solved by me reporting a security
flaw that I ought to have known about before-hand?
Google, on the other hand, tries to give you the most appropriate page
when you search for something.
--
--My blog is at blog.russnelson.com | If you want to find
Crynwr sells support for free software | PGPok | injustice in economic
521 Pleasant Valley Rd. | +1 315-323-1241 | affairs, look for the
Potsdam, NY 13676-3213 | | hand of a legislator.