Re: Suhosin patch disabled by default in Debian php5 builds

Hi Pierre, > And if security features in Suhosin is so critical, I also why its > users rely on one single person for that, the bus factor is quite > high. everybody is free to join the Suhosin team. People rely on me because they consider me the person knowing most about PHP security. And the same people do not trust PHP.net anymore. Don't forget that the last 2 releases of PHP had to be followed by new versions because both times code was commited AFTER the last RC that introduced a security vulnerability. People do not trust you anymore. And it is a joke that you are running around telling everyone that all is perfect now with your RFC and new processes. Reality shows a different picture. BTW: "rely on a single person" is also funny. At SektionEins we have more than one person looking into Suhosin. Regards, Stefan Esser